title: SSL handshake faillure with node.js server
body: <p>I'm currently trying to create a secure connection with socket.io, and I really can't achieve that for now. Trying to check if my certificates are rights, I tried to create a basic https server in nodeJS.</p>
  
  <pre><code>var fs = require('fs');
  var certDir = "/path/to/the/certificates/cert-test/";
  require("https").createServer(
  {
      key  : fs.readFileSync(certDir + 'srv.key'),
      cert : fs.readFileSync(certDir + 'crt.pem'),
  },
  function(request, response){
      response.writeHeader(200, {"Content-Type": "text/plain"});
      response.write("Hello World!\n");
      response.end();
  }).listen(8082).on('clientError', function(e){
      console.log(e);
  });
  </code></pre>
  
  <p>The equivalent with http works fine, but it's impossible to make this one work. I upgraded the node version to v0.12.4, npm to 2.11.0, https is 1.0.0 (and for further enquiries, socket.io is 1.3.5). The server is on AWS , with a bitnami instance, Ubuntu 12.04.5 LTS, kernel version 3.2.0-84-virtual and OpenSSL is 1.0.1i.</p>
  
  <p>I try to reach the server through <a href="https://node.foobar.com:8082" rel="nofollow noreferrer">https://node.foobar.com:8082</a> (both in my browser and with curl), but I never achieve a proper handshake.</p>
  
  <p>The server detects the following errors : </p>
  
  <ul>
  <li>[Error: 3074971392:error:1408A0C1:SSL
  routines:SSL3_GET_CLIENT_HELLO:no shared
  cipher:../deps/openssl/openssl/ssl/s3_srvr.c:1389: ] </li>
  <li>[Error: 3074971392:error:140A1175:SSL
  routines:SSL_BYTES_TO_CIPHER_LIST:inappropriate
  fallback:../deps/openssl/openssl/ssl/ssl_lib.c:1481: ]</li>
  </ul>
  
  <p>I tried to check the ciphers available on the server and the ones available on my computer, and there are many matches. So guys, I'm really out of ideas, and I would appreciate some help...</p>
  
  <p><strong><em>EDIT</em></strong></p>
  
  <p>output for <code>openssl x509 -in crt.pem -inform PEM -text -noout</code> : </p>
  
  <pre><code>Certificate:
      Data:
          Version: 3 (0x2)
          Serial Number:
              af:b7:19:35:7b:0e:87:38
      Signature Algorithm: sha256WithRSAEncryption
          Issuer: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc.,    OU=http://certs.godaddy.com/repository/, CN=Go Daddy Secure Certificate     Authority - G2
          Validity
              Not Before: Jan  6 10:11:41 2015 GMT
              Not After : Jan 25 08:15:28 2016 GMT
          Subject: OU=Domain Control Validated, CN=node.foobar.com
          Subject Public Key Info:
              Public Key Algorithm: rsaEncryption
              Public-Key: (2048 bit)
              Modulus:
                  00:ce:93:8c:6a:0a:54:d8:b8:02:94:0d:d4:23:98:
                  80:98:5e:42:fb:b2:4a:f7:62:68:82:42:32:dc:6f:
                  5d:02:3a:b8:34:7c:9f:1c:e6:83:94:a3:1a:1e:25:
                  aa:58:69:4b:4d:76:8e:07:73:09:d3:6a:20:65:ad:
                  40:f5:a4:75:fa:51:79:af:94:1d:c3:39:c0:d4:70:
                  e0:f0:61:e7:26:d8:78:b8:58:7e:0e:85:22:a2:83:
                  09:69:85:f6:3e:b1:de:80:71:07:88:d8:9f:f9:6a:
                  8b:d4:ad:61:bc:c2:bb:98:6c:36:71:d8:20:3f:d1:
                  d4:d8:0e:91:d7:eb:42:3f:f3:98:97:fa:c4:cb:78:
                  04:c2:ef:12:ba:a5:cf:cd:05:44:ad:a1:cc:ff:04:
                  b9:e1:74:ab:09:8a:58:1b:11:e6:f9:8f:28:c2:39:
                  3d:71:1e:e4:e2:e4:a4:f7:45:94:04:f2:4a:fc:62:
                  ab:b5:9a:18:56:e8:40:4d:12:17:a7:26:07:54:db:
                  5b:87:99:56:9e:5c:94:28:0d:6c:29:9d:06:56:3b:
                  5e:c2:1f:6b:1f:6a:90:c2:97:24:77:63:32:26:f5:
                  25:d6:02:73:61:6b:69:20:39:a7:be:af:51:27:c5:
                  a5:b4:a4:1f:e2:36:fc:15:25:30:fe:08:8f:0a:12:
                  5f:c9
              Exponent: 65537 (0x10001)
      X509v3 extensions:
          X509v3 Basic Constraints: critical
              CA:FALSE
          X509v3 Extended Key Usage: 
              TLS Web Server Authentication, TLS Web Client Authentication
          X509v3 Key Usage: critical
              Digital Signature, Key Encipherment
          X509v3 CRL Distribution Points: 
  
              Full Name:
                URI:http://crl.godaddy.com/gdig2s1-87.crl
  
          X509v3 Certificate Policies: 
              Policy: 2.16.840.1.114413.1.7.23.1
                CPS: http://certificates.godaddy.com/repository/
  
          Authority Information Access: 
              OCSP - URI:http://ocsp.godaddy.com/
              CA Issuers - URI:http://certificates.godaddy.com/repository/gdig2.crt
  
          X509v3 Authority Key Identifier: 
              keyid:40:C2:BD:27:8E:CC:34:83:30:A2:33:D7:FB:6C:B3:F0:B4:2C:80:CE
  
          X509v3 Subject Alternative Name: 
              DNS:foobar.com, DNS:www.foobar.com, DNS:www.foo.bar.com
          X509v3 Subject Key Identifier: 
              70:FE:A0:B4:00:2E:14:98:B8:CA:BF:C8:63:A7:23:63:7C:FA:48:82
  Signature Algorithm: sha256WithRSAEncryption
       70:b7:dd:2b:ed:b9:7b:4e:4d:b1:13:26:7b:5d:f4:10:1f:28:
       a4:b8:f5:99:4e:ee:34:56:b1:eb:06:19:d8:14:c8:28:44:fe:
       63:f1:2e:58:73:c7:22:57:1a:4f:2c:00:ef:2b:f8:c6:52:09:
       71:1a:68:00:35:a0:f8:df:57:c5:98:f8:43:68:ba:b5:ff:3e:
       e1:a5:ad:6a:85:64:dd:40:72:d1:9d:04:61:54:cc:7c:92:c4:
       b3:68:6a:77:32:1b:49:ea:6c:7e:28:c7:67:ce:1d:ed:29:49:
       d6:9c:76:4d:a3:f1:a5:f5:0a:0a:92:72:7e:0a:1a:22:43:32:
       18:9f:3f:fe:62:e0:57:ee:92:9d:fb:5f:bd:4b:c9:c4:1d:ba:
       cb:0d:3c:b9:00:2f:79:fc:5d:cd:df:9e:d7:c9:79:3b:45:c4:
       7c:ad:cb:47:6d:8e:82:cc:dd:8e:2d:86:fc:94:4b:bf:9d:8e:
       37:37:90:1c:74:73:f1:93:e7:f1:c9:e3:e0:d9:5c:fb:d6:3d:
       09:6b:d5:45:ab:47:d2:65:69:6c:af:81:08:35:6c:87:7f:dd:
       fa:26:2e:8a:bf:4e:53:c1:70:1a:0a:e1:7f:e9:18:c5:82:f1:
       90:9e:6c:29:7b:b7:cc:a3:25:3f:7f:8d:f3:b5:58:25:62:56:
       64:50:43:b3
  </code></pre>
  
  <p>output for <code>openssl s_client -connect node.foobar.com:8082 -tls1 -servername node.foobar.com</code>:</p>
  
  <pre><code>CONNECTED(00000003)
  3073997000:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1262:SSL alert number 40
  3073997000:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:598:
  ---
  no peer certificate available
  ---
  No client certificate CA names sent
  ---
  SSL handshake has read 7 bytes and written 0 bytes
  ---
  New, (NONE), Cipher is (NONE)
  Secure Renegotiation IS NOT supported
  Compression: NONE
  Expansion: NONE
  SSL-Session:
      Protocol  : TLSv1
      Cipher    : 0000
      Session-ID: 
      Session-ID-ctx: 
      Master-Key: 
      Key-Arg   : None
      PSK identity: None
      PSK identity hint: None
      SRP username: None
      Start Time: 1433377982
      Timeout   : 7200 (sec)
      Verify return code: 0 (ok)
  ---
  </code></pre>
  
  <p>I tried <code>openssl s_client -connect node.foobar.com:8082 -tls1_2 -servername node.foobar.com</code>, and here is the answer I got :</p>
  
  <pre><code>CONNECTED(00000003)
  3074009288:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1262:SSL alert number 40
  3074009288:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:598:
  ---
  no peer certificate available
  ---
  No client certificate CA names sent
  ---
  SSL handshake has read 7 bytes and written 0 bytes
  ---
  New, (NONE), Cipher is (NONE)
  Secure Renegotiation IS NOT supported
  Compression: NONE
  Expansion: NONE
  SSL-Session:
      Protocol  : TLSv1.2
      Cipher    : 0000
      Session-ID: 
      Session-ID-ctx: 
      Master-Key: 
      Key-Arg   : None
      PSK identity: None
      PSK identity hint: None
      SRP username: None
      Start Time: 1433466977
      Timeout   : 7200 (sec)
      Verify return code: 0 (ok)
  ---
  </code></pre>
  
  <p>By the way, in order to keep the server up, it runs with the forever package (v0.14.1).</p>
  
  <p>Available ciphers : </p>
  
  <pre><code>ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:SRP-DSS-AES-256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:SRP-AES-256-CBC-SHA:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-SHA:PSK-AES256-CBC-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:SRP-DSS-AES-128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:SRP-AES-128-CBC-SHA:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:DHE-RSA-SEED-SHA:DHE-DSS-SEED-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES128-SHA256:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:SEED-SHA:CAMELLIA128-SHA:IDEA-CBC-SHA:PSK-AES128-CBC-SHA:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5:PSK-RC4-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:SRP-DSS-3DES-EDE-CBC-SHA:SRP-RSA-3DES-EDE-CBC-SHA:SRP-3DES-EDE-CBC-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-SHA:ECDH-ECDSA-DES-CBC3-SHA:DES-CBC3-SHA:PSK-3DES-EDE-CBC-SHA:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5
  </code></pre>
  
  <p>Output for <code>openssl s_client -connect node.foobar.com:8082 -tls1 -cipher "ECDHE-RSA-AES256-GCM-SHA384" -servername node.foobar.com</code></p>
  
  <pre><code>CONNECTED(00000003)
  3073722568:error:140830B5:SSL routines:SSL3_CLIENT_HELLO:no ciphers     available:s3_clnt.c:757:
  ---
  no peer certificate available
  ---
  No client certificate CA names sent
  ---
  SSL handshake has read 0 bytes and written 0 bytes
  ---
  New, (NONE), Cipher is (NONE)
  Secure Renegotiation IS NOT supported
  Compression: NONE
  Expansion: NONE
  SSL-Session:
      Protocol  : TLSv1
      Cipher    : 0000
      Session-ID: 
      Session-ID-ctx: 
      Master-Key: 
      Key-Arg   : None
      PSK identity: None
      PSK identity hint: None
      SRP username: None
      Start Time: 1433512430
      Timeout   : 7200 (sec)
      Verify return code: 0 (ok)
  ---
  </code></pre>
  
  <p>By the way, as a subsidiary question, except for the http becoming a     https for the request of the socket.io/socket.io.js file I have to get in     order to create the connection, is there anything else I will have to change to be able to use this package on my website?</p>
  
  <p>Thank you.</p>