TLS handshake failure
The TCP connection succeeded and the private conversation never started. That combination narrows the cause enormously, because it rules out everything below TLS.
What it looks like
A complete three-way handshake, a ClientHello naming the host the client wanted, and then either no ServerHello at all or an alert. The report grades it Degraded — the transport was faultless — and says “The private conversation never started”.
What it rules out
Routing, firewalls and reachability. All three already worked, or the TCP handshake could not have completed. Whatever is wrong is in the negotiation itself.
What causes it
- No certificate for the name asked for. The report shows the SNI; if the server has no certificate matching it, some servers simply stop.
- No version in common. A client that has dropped TLS 1.0 and 1.1 meeting a server that only offers them. This is now a common cause and will become more so.
- No cipher suite in common, for the same reason.
- Something in the middle. An interception proxy that cannot complete the handshake it is trying to sit inside.
What to do
One command usually names it:
openssl s_client -connect HOST:443 -servername NAME. The alert it prints is the
server's own explanation — handshake failure for no common version or cipher,
unrecognized name for an SNI the server does not serve. Add
-tls1_2 or -tls1_3 to test one version at a time.