SSL handshake failed: The TLS handshake did not complete

A generic handshake failure reported by servers, CDNs and API clients rather than browsers. The connection reached the server but the TLS negotiation aborted — protocol mismatch, certificate rejection, or a required client certificate.

Short answer

A generic handshake failure reported by servers, CDNs and API clients rather than browsers. The connection reached the server but the TLS negotiation aborted — protocol mismatch, certificate rejection, or a required client certificate.

What SSL handshake failed means

The phrase appears in nginx logs, Cloudflare 525 pages, curl output and API SDKs. It always means the same thing: TCP connected, TLS did not. The useful detail is in whichever side logged it.

Causes and fixes, most likely first

1. No shared protocol or cipher between the two sides. Compare the versions each side supports. Enable TLS 1.2/1.3 on the origin.
2. The server requires a client certificate that was not presented. Present the client certificate, or turn off mutual TLS for that route if it was enabled unintentionally.
3. SNI is missing, so the server selects a default certificate that does not match. Ensure the client sends SNI. Very old clients and some scripted requests omit it.

How to stop it happening again

• Log the TLS version and cipher on the origin so handshake failures can be attributed rather than guessed.

Check your own domain

An external handshake attempt reproduces the failure from outside your network and reports the exact stage it aborted at.

Frequently asked questions

What is the difference between a handshake failure and a certificate error?

A certificate error means the handshake completed far enough for the browser to inspect and reject the certificate. A handshake failure means negotiation aborted before that point.