title: CouchDB won't work over SSL
body: <p>I am running the <a href="https://hub.docker.com/_/couchdb/" rel="nofollow noreferrer">CouchDB Docker container</a>, V.2.1.1. Everything is working at this point except for SSL. I am following the <a href="http://docs.couchdb.org/en/latest/config/http.html#secure-socket-level-options" rel="nofollow noreferrer">CouchDB documentation on SSL setup</a>. The container has OpenSSL 1.0.1t.</p>
  
  <p>As shown in the documentation, I am using a self-signed certificate. When I try to connect to the SSL page on port 6984:</p>
  
  <p>Chrome tells me</p>
  
  <pre><code>"ERR_CONNECTION_CLOSED".
  </code></pre>
  
  <p>curl gives me</p>
  
  <p><strong>curl -k <a href="https://localhost:6984" rel="nofollow noreferrer">https://localhost:6984</a></strong></p>
  
  <pre><code>curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to localhost:6984
  </code></pre>
  
  <p>In the server log, I get a whole lot of this.</p>
  
  <pre><code>hello terminated with reason: no function clause matching ssl_cipher:hash_algorithm
  </code></pre>
  
  <p>A search on this last error turns up information indicating that the Erlang version has an issue. However, I believe the CouchDB container has an already patched version. I did try and upgrade with:</p>
  
  <pre><code>apt-get install Erlang
  </code></pre>
  
  <p>This made no difference. Search results also point to the version of OpenSSL having a problem. I upgraded to OpenSSL 1.1.1 from source, Recreated the certificates, and still, the issue persists.</p>
  
  <p>As requested, here is the output from a few more commands.</p>
  
  <p><strong>openssl s_client -connect localhost:6984</strong></p>
  
  <pre><code>CONNECTED(00000005)
  140736008328136:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.50.2/libressl/ssl/s23_lib.c:124:
  ---
  no peer certificate available
  ---
  No client certificate CA names sent
  ---
  SSL handshake has read 0 bytes and written 318 bytes
  ---
  New, (NONE), Cipher is (NONE)
  Secure Renegotiation IS NOT supported
  Compression: NONE
  Expansion: NONE
  No ALPN negotiated
  ---
  </code></pre>
  
  <p><strong>curl --version</strong></p>
  
  <pre><code>curl 7.54.0 (x86_64-apple-darwin17.0) libcurl/7.54.0 LibreSSL/2.0.20 zlib/1.2.11 nghttp2/1.24.0
  Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
  Features: AsynchDNS IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz HTTP2 UnixSockets HTTPS-proxy
  </code></pre>
  
  <p><strong>curl -k -v <a href="https://localhost:6984" rel="nofollow noreferrer">https://localhost:6984</a></strong></p>
  
  <pre><code>* Rebuilt URL to: https://localhost:6984/
  *   Trying ::1...
  * TCP_NODELAY set
  * Connected to localhost (::1) port 6984 (#0)
  * ALPN, offering h2
  * ALPN, offering http/1.1
  * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
  * successfully set certificate verify locations:
  *   CAfile: /etc/ssl/cert.pem
    CApath: none
  * TLSv1.2 (OUT), TLS handshake, Client hello (1):
  * LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to localhost:6984
  * stopped the pause stream!
  * Closing connection 0
  curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to localhost:6984
  </code></pre>
  
  <p><strong>curl -k --ciphers DEFAULT <a href="https://localhost:6984" rel="nofollow noreferrer">https://localhost:6984</a></strong></p>
  
  <pre><code>curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to localhost:6984
  </code></pre>
  
  <p><strong>curl -k --ciphers ECDHE-RSA-AES256-GCM-SHA384 <a href="https://localhost:6984" rel="nofollow noreferrer">https://localhost:6984</a></strong></p>
  
  <pre><code>curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to localhost:6984
  </code></pre>
  
  <p>The output from the following three commands is very similar. I will just show the differences. However, it seems that a handshake is now taking place with all of these commands. </p>
  
  <p><strong>$ openssl s_client -tls1 -connect localhost:6984</strong></p>
  
  <pre><code>CONNECTED(00000005)
  SSL handshake has read 1762 bytes and written 400 bytes
  New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
  Compression: NONE
  Expansion: NONE
  SSL-Session:
      Protocol  : TLSv1
      Cipher    : DHE-RSA-AES256-SHA
      Session-ID: 18C5DF9DCA1B8AA0DBD33258BCD253053F8D1D91B524B0561A1C0FAB8CFB5146
      Master-Key: FD0C57E4E8FB992C0323D43930C104D82B69C4200F42E03EDB51E38A47448D62FDCB6E813583E2177A339B74B4D0CC4A
      Start Time: 1525593658
      Timeout   : 7200 (sec)
  </code></pre>
  
  <p><strong>$ path/to/brew/version/of/openssl s_client -connect localhost:6984</strong></p>
  
  <pre><code>CONNECTED(00000003)
  Peer signing digest: SHA512
  Server Temp Key: DH, 1024 bits
  SSL handshake has read 1796 bytes and written 537 bytes
  New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA256
  SSL-Session:
      Protocol  : TLSv1.2
      Cipher    : DHE-RSA-AES256-SHA256
      Session-ID: A19D67CBE634843181859DB2C3C4D1A3416C9F7DAA85CF470D412FE723AD49B4
      Master-Key: 61B711B9BEDB651868607527439D01B421780C7D584FCE68C4754A7A7F3563923409C03F4B68BB7914397B48A92FC756
      Key-Arg   : None
      PSK identity: None
      PSK identity hint: None
      SRP username: None
      Start Time: 1525593604
      Timeout   : 300 (sec)
  </code></pre>
  
  <p><strong>$ path/to/brew/version/of/openssl s_client -tls1 -connect localhost:6984</strong></p>
  
  <pre><code>SSL handshake has read 1762 bytes and written 397 bytes
  New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
  SSL-Session:
      Protocol  : TLSv1
      Cipher    : DHE-RSA-AES256-SHA
      Session-ID: 6CC7FFE1C7CE258F105C7ADD5D8A9C0DFFB26A5A9555EB218EE48E519D361208
      Master-Key: 2D6DFAC01544F6FF5F4138D877A4105485D5A2F77B58B4796822625E2E602455C38E3EEB2CBACE07FA03D207B07C715E
      Start Time: 1525593717
      Timeout   : 7200 (sec)
  </code></pre>
  
  <p><strong>$ curl -k --tlsv1 <a href="https://localhost:6984" rel="nofollow noreferrer">https://localhost:6984</a></strong></p>
  
  <pre><code>curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to localhost:6984
  </code></pre>
  
  <p><strong>$ curl -k --tlsv1.0 <a href="https://localhost:6984" rel="nofollow noreferrer">https://localhost:6984</a></strong></p>
  
  <pre><code>{"couchdb":"Welcome","version":"2.1.1","features":["scheduler"],"vendor":{"name":"The Apache Software Foundation"}}
  </code></pre>
  
  <p>So I am guessing there is a problem with the built-in version of LibreSSL? The next question is what can be done about it?</p>