title: javax.net.ssl.SSLException: Received fatal alert: unexpected_message
body: <p>Encountered this SSLException when using curl to hit a Java web service:</p>
  
  <pre><code>javax.net.ssl.SSLException: Received fatal alert: unexpected_message
      at sun.security.ssl.Alerts.getSSLException(Alerts.java:208) ~[na:1.8.0_65]
      at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1666) ~[na:1.8.0_65]
      at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1634) ~[na:1.8.0_65]
      at sun.security.ssl.SSLEngineImpl.recvAlert(SSLEngineImpl.java:1800) ~[na:1.8.0_65]
      at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:1083) ~[na:1.8.0_65]
      at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:907) ~[na:1.8.0_65]
      at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781) ~[na:1.8.0_65]
      at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624) ~[na:1.8.0_65]
      at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1225) ~[netty-3.6.6.Final.jar:na]
      at org.jboss.netty.handler.ssl.SslHandler.decode(SslHandler.java:913) ~[netty-3.6.6.Final.jar:na]
      at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:425) ~[netty-3.6.6.Final.jar:na]
      at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303) ~[netty-3.6.6.Final.jar:na]
      at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268) ~[netty-3.6.6.Final.jar:na]
      at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255) ~[netty-3.6.6.Final.jar:na]
      at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88) ~[netty-3.6.6.Final.jar:na]
      at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:109) ~[netty-3.6.6.Final.jar:na]
      at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:312) ~[netty-3.6.6.Final.jar:na]
      at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:90) ~[netty-3.6.6.Final.jar:na]
      at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178) ~[netty-3.6.6.Final.jar:na]
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [na:1.8.0_65]
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [na:1.8.0_65]
      at java.lang.Thread.run(Thread.java:745) [na:1.8.0_65]
  </code></pre>
  
  <p>cURL output:</p>
  
  <pre><code>[team@pins ~]$ curl -v --data '' 'https://example.com:6521/access/register'
  * Adding handle: conn: 0x7f857480bb00
  * Adding handle: send: 0
  * Adding handle: recv: 0
  * Curl_addHandleToPipeline: length: 1
  * - Conn 0 (0x7f857480bb00) send_pipe: 1, recv_pipe: 0
  * About to connect() to example.com port 6521 (#0)
  *   Trying xxx.xxx.xxx.xxx...
  * Connected to example.com (xxx.xxx.xxx.xxx) port 6521 (#0)
  * Unknown SSL protocol error in connection to example.com:-9800
  * Closing connection 0
  curl: (35) Unknown SSL protocol error in connection to example.com:-9800
  </code></pre>
  
  <p>Strangely, the same command works on another machine with an older version of cURL. There, it appears to be working fine with AES128-SHA.</p>
  
  <p>I suspect it's a problem with the available ciphers sent during ssl negotiation, but I'm unsure how to debug that. Is there a way to see exactly what cURL sent? Or exactly what the server received?</p>