title: javax.net.ssl.SSLHandshakeException: Received fatal alert: illegal_parameter
body: <p>I'm using <code>OKHttp 4.0.0</code> (java 11, Mac Mojave) and getting <code>javax.net.ssl.SSLHandshakeException: Received fatal alert: illegal_parameter</code>. The code and log are below:</p>
  
  <p>Code</p>
  
  <pre><code>KeyStore clientStore = KeyStore.getInstance("PKCS12");
  clientStore.load(new FileInputStream(new File("/Users/me/Downloads/certs/my-cert.pfx")), "my-password".toCharArray());
  KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
  kmf.init(clientStore, "my-password".toCharArray());
  KeyManager[] kms = kmf.getKeyManagers();
  
  KeyStore trustStore = KeyStore.getInstance("JKS");
  trustStore.load(null, "changeit".toCharArray());
  
  TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
  tmf.init((KeyStore)null);
  TrustManager[] tms = tmf.getTrustManagers();
  
  final SSLContext sslContext = SSLContext.getInstance("TLS");
  sslContext.init(kms,tms,new SecureRandom());
  
  //thin wrapper around Okhttp client
  String res = TLSHttpClientBuilder.aHttpsClient();
  //this calls sslSocketFactory(sslSocketFactory, trustManager) on the builder 
  .withSslSocketFactory(sslContext.getSocketFactory(), (X509TrustManager) tmf.getTrustManagers()[0])
      .withDebugModeEnabled()
      .build(new MetricRegistry())
      .post("https://staging.xxx", Map.of(), PAYLOAD, String.class);
  </code></pre>
  
  <p>Partial log output showing OkHttp events and exception. It looks to be failing late in the process after the <code>responseHeadersStart</code> event fires.</p>
  
  <pre><code>Jul 22, 2019 12:41:44 AM okhttp3.internal.platform.Platform log
  INFO: --&gt; END POST (678-byte body)
  Jul 22, 2019 12:41:44 AM okhttp3.internal.platform.Platform log
  INFO: [54 ms] dnsStart: staging.ws-cert.idms.lexisnexis.com
  Jul 22, 2019 12:41:44 AM okhttp3.internal.platform.Platform log
  INFO: [195 ms] dnsEnd: [staging.xxxx]
  Jul 22, 2019 12:41:44 AM okhttp3.internal.platform.Platform log
  INFO: [204 ms] connectStart: staging.xxxx DIRECT
  Jul 22, 2019 12:41:44 AM okhttp3.internal.platform.Platform log
  INFO: [262 ms] secureConnectStart
  Jul 22, 2019 12:41:45 AM okhttp3.internal.platform.Platform log
  INFO: [574 ms] secureConnectEnd: Handshake{tlsVersion=TLS_1_2 cipherSuite=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 peerCertificates=[CN=xxx, O=xxx, L=xxx, ST=xx, C=xx, SERIALNUMBER=xxx, OID.xxxx=xxxx, xxx=US, xxx=xxx, CN=Thawte EV RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US, CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US] localCertificates=[CN=xxxx]}
  Jul 22, 2019 12:41:45 AM okhttp3.internal.platform.Platform log
  INFO: [574 ms] connectEnd: http/1.1
  Jul 22, 2019 12:41:45 AM okhttp3.internal.platform.Platform log
  INFO: [576 ms] connectionAcquired: Connection{staging.xxx:443, proxy=DIRECT hostAddress=staging.xxxx:443 cipherSuite=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 protocol=http/1.1}
  Jul 22, 2019 12:41:45 AM okhttp3.internal.platform.Platform log
  INFO: [578 ms] requestHeadersStart
  Jul 22, 2019 12:41:45 AM okhttp3.internal.platform.Platform log
  INFO: [579 ms] requestHeadersEnd
  Jul 22, 2019 12:41:45 AM okhttp3.internal.platform.Platform log
  INFO: [579 ms] requestBodyStart
  Jul 22, 2019 12:41:45 AM okhttp3.internal.platform.Platform log
  INFO: [581 ms] requestBodyEnd: byteCount=678
  Jul 22, 2019 12:41:45 AM okhttp3.internal.platform.Platform log
  INFO: [582 ms] responseHeadersStart
  Jul 22, 2019 12:41:45 AM okhttp3.internal.platform.Platform log
  INFO: [683 ms] responseFailed: javax.net.ssl.SSLHandshakeException: Received fatal alert: illegal_parameter
  Jul 22, 2019 12:41:45 AM okhttp3.internal.platform.Platform log
  INFO: &lt;-- HTTP FAILED: javax.net.ssl.SSLHandshakeException: Received fatal alert: illegal_parameter
  Jul 22, 2019 12:41:45 AM okhttp3.internal.platform.Platform log
  INFO: [685 ms] connectionReleased
  Jul 22, 2019 12:41:45 AM okhttp3.internal.platform.Platform log
  INFO: [685 ms] callFailed: javax.net.ssl.SSLHandshakeException: Received fatal alert: illegal_parameter
  Exception in thread "main" java.lang.IllegalStateException: javax.net.ssl.SSLHandshakeException: Received fatal alert: illegal_parameter
  </code></pre>
  
  <p><strong>Update</strong></p>
  
  <p>Running with <code>-Djava.net.debug=ssl:handshake</code></p>
  
  <pre><code>Jul 22, 2019 8:35:42 AM okhttp3.internal.platform.Platform log
  INFO: [121 ms] secureConnectStart
  javax.net.ssl|WARNING|01|main|2019-07-22 08:35:42.755 EDT|SignatureScheme.java:282|Signature algorithm, ed25519, is not supported by the underlying providers
  javax.net.ssl|WARNING|01|main|2019-07-22 08:35:42.756 EDT|SignatureScheme.java:282|Signature algorithm, ed448, is not supported by the underlying providers
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.760 EDT|SSLExtensions.java:256|Ignore, context unavailable extension: cookie
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.764 EDT|PreSharedKeyExtension.java:624|No session to resume.
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.764 EDT|SSLExtensions.java:256|Ignore, context unavailable extension: pre_shared_key
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.764 EDT|ClientHello.java:651|Produced ClientHello handshake message (
  "ClientHello": {
    "client version"      : "TLSv1.2",
    "random"              : "94 C0 48 D0 25 B0 73 86 7F 90 15 5F 59 4B 76 30 8A A7 5C 46 08 D5 F0 28 27 59 EF 89 8A 10 91 38",
    "session id"          : "B7 99 79 9F 26 AF B4 BD FC 57 5D F4 5B 00 65 55 E9 6D D7 9B C3 26 FF 6F 6E 6A FD 5C 5F 63 32 F9",
    "cipher suites"       : "[TLS_AES_128_GCM_SHA256(0x1301), TLS_AES_256_GCM_SHA384(0x1302), TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384(0xC02C), TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256(0xC02B), TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384(0xC030), TLS_RSA_WITH_AES_256_GCM_SHA384(0x009D), TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256(0xC02F), TLS_RSA_WITH_AES_128_GCM_SHA256(0x009C), TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA(0xC014), TLS_RSA_WITH_AES_256_CBC_SHA(0x0035), TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA(0xC013), TLS_RSA_WITH_AES_128_CBC_SHA(0x002F)]",
    "compression methods" : "00",
    "extensions"          : [
  
    ]
  }
  )
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.865 EDT|ServerHello.java:866|Consuming ServerHello handshake message (
  "ServerHello": {
    "server version"      : "TLSv1.2",
    "random"              : "68 41 E1 8E 09 CF EA BD EA 93 D3 4B 85 A0 4C 72 D0 16 EC 71 C9 F0 34 9A 97 1E 9D 57 73 B8 37 F2",
    "session id"          : "4C AC BB F5 B3 22 6C 2B B0 2A D5 54 3F 63 90 43 70 F7 95 A3 90 91 B7 6C 2F 6A A3 08 8A D9 66 AF",
    "cipher suite"        : "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384(0xC030)",
    "compression methods" : "00",
    "extensions"          : [
      "ec_point_formats (11)": {
        "formats": [uncompressed]
      },
      "renegotiation_info (65,281)": {
        "renegotiated connection": [&lt;no renegotiated connection&gt;]
      },
      "server_name (0)": {
        &lt;empty extension_data field&gt;
      }
    ]
  }
  )
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.866 EDT|SSLExtensions.java:169|Ignore unavailable extension: supported_versions
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.866 EDT|ServerHello.java:962|Negotiated protocol version: TLSv1.2
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.866 EDT|SSLExtensions.java:188|Consumed extension: renegotiation_info
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.866 EDT|SSLExtensions.java:188|Consumed extension: server_name
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.867 EDT|SSLExtensions.java:169|Ignore unavailable extension: max_fragment_length
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.867 EDT|SSLExtensions.java:169|Ignore unavailable extension: status_request
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.867 EDT|SSLExtensions.java:188|Consumed extension: ec_point_formats
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.867 EDT|SSLExtensions.java:169|Ignore unavailable extension: status_request_v2
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.867 EDT|SSLExtensions.java:159|Ignore unsupported extension: supported_versions
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.868 EDT|SSLExtensions.java:159|Ignore unsupported extension: key_share
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.868 EDT|SSLExtensions.java:188|Consumed extension: renegotiation_info
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.868 EDT|SSLExtensions.java:159|Ignore unsupported extension: pre_shared_key
  javax.net.ssl|WARNING|01|main|2019-07-22 08:35:42.868 EDT|SSLExtensions.java:211|Ignore impact of unsupported extension: server_name
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.868 EDT|SSLExtensions.java:203|Ignore unavailable extension: max_fragment_length
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.868 EDT|SSLExtensions.java:203|Ignore unavailable extension: status_request
  javax.net.ssl|WARNING|01|main|2019-07-22 08:35:42.868 EDT|SSLExtensions.java:211|Ignore impact of unsupported extension: ec_point_formats
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.869 EDT|SSLExtensions.java:203|Ignore unavailable extension: application_layer_protocol_negotiation
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.869 EDT|SSLExtensions.java:203|Ignore unavailable extension: status_request_v2
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.869 EDT|SSLExtensions.java:203|Ignore unavailable extension: extended_master_secret
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.869 EDT|SSLExtensions.java:203|Ignore unavailable extension: supported_versions
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.869 EDT|SSLExtensions.java:203|Ignore unavailable extension: key_share
  javax.net.ssl|WARNING|01|main|2019-07-22 08:35:42.869 EDT|SSLExtensions.java:211|Ignore impact of unsupported extension: renegotiation_info
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.869 EDT|SSLExtensions.java:203|Ignore unavailable extension: pre_shared_key
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.876 EDT|CertificateMessage.java:358|Consuming server Certificate handshake message (
  "Certificates": [
    "certificate" : {
      "version"            : "v3",
      "serial number"      : "03 31 01 5A E5 A7 53 ED F2 78 1A A4 9A 75 EE A8",
      "signature algorithm": "SHA256withRSA",
      "issuer"             : "CN=Thawte EV RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US",
      "not before"         : "2019-02-25 19:00:00.000 EST",
      "not  after"         : "2020-02-26 07:00:00.000 EST",
      "subject"            : "CN=xxx, O=xxx., L=Boca Raton, ST=Florida, C=US, SERIALNUMBER=xxx=Minnesota, xxxx=US, OID.2.5.4.15=xxx",
      "subject public key" : "RSA",
      "extensions"         : [
        {
          ObjectId: 1.3.6.1.4.1.11129.2.4.2 Criticality=false
        },
        {
          ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
          AuthorityInfoAccess [
            [
             accessMethod: ocsp
             accessLocation: URIName: http://status.thawte.com
          , 
             accessMethod: caIssuers
             accessLocation: URIName: http://cacerts.thawte.com/ThawteEVRSACA2018.crt
          ]
          ]
        },
        {
          ObjectId: 2.5.29.35 Criticality=false
          AuthorityKeyIdentifier [
          KeyIdentifier [
          0000: E7 01 FC 0C 16 18 CA 7D   B2 8C EC 87 27 A3 6F 61  ............'.oa
          0010: 81 3B 84 39                                        .;.9
          ]
          ]
        },
        {
          ObjectId: 2.5.29.19 Criticality=false
          BasicConstraints:[
            CA:false
            PathLen: undefined
          ]
        },
        {
          ObjectId: 2.5.29.31 Criticality=false
          CRLDistributionPoints [
            [DistributionPoint:
               [URIName: http://cdp.thawte.com/ThawteEVRSACA2018.crl]
          ]]
        },
        {
          ObjectId: 2.5.29.32 Criticality=false
          CertificatePolicies [
            [CertificatePolicyId: [2.16.840.1.114412.2.1]
          [PolicyQualifierInfo: [
            qualifierID: 1.3.6.1.5.5.7.2.1
            qualifier: 0000: 16 1C 68 74 74 70 73 3A   2F 2F 77 77 77 2E 64 69  ..https://www.di
          0010: 67 69 63 65 72 74 2E 63   6F 6D 2F 43 50 53        gicert.com/CPS
  
          ]]  ]
            [CertificatePolicyId: [2.23.140.1.1]
          []  ]
          ]
        },
        {
          ObjectId: 2.5.29.37 Criticality=false
          ExtendedKeyUsages [
            serverAuth
            clientAuth
          ]
        },
        {
          ObjectId: 2.5.29.15 Criticality=true
          KeyUsage [
            DigitalSignature
            Key_Encipherment
          ]
        },
        {
          ObjectId: 2.5.29.17 Criticality=false
          SubjectAlternativeName [
            DNSName: xxx.com
            DNSName: xxx.com
            DNSName: xxxx.com
            DNSName: staging.xxxx.com
            DNSName: staging.xxxx.com
            DNSName: staging.xxxx.com
          ]
        },
        {
          ObjectId: 2.5.29.14 Criticality=false
          SubjectKeyIdentifier [
          KeyIdentifier [
          0000: 51 55 3F FF 74 58 F3 1F   55 03 38 58 07 B6 17 13  QU?.tX..U.8X....
          0010: 1B A3 B5 E7                                        ....
          ]
          ]
        }
      ]},
    "certificate" : {
      "version"            : "v3",
      "serial number"      : "06 96 8F 96 4A E8 23 56 C7 4E 17 C2 B5 36 5B 00",
      "signature algorithm": "SHA256withRSA",
      "issuer"             : "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US",
      "not before"         : "2017-11-06 07:22:57.000 EST",
      "not  after"         : "2027-11-06 08:22:57.000 EDT",
      "subject"            : "CN=Thawte EV RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US",
      "subject public key" : "RSA",
      "extensions"         : [
        {
          ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
          AuthorityInfoAccess [
            [
             accessMethod: ocsp
             accessLocation: URIName: http://ocsp.digicert.com
          ]
          ]
        },
        {
          ObjectId: 2.5.29.35 Criticality=false
          AuthorityKeyIdentifier [
          KeyIdentifier [
          0000: B1 3E C3 69 03 F8 BF 47   01 D4 98 26 1A 08 02 EF  .&gt;.i...G...&amp;....
          0010: 63 64 2B C3                                        cd+.
          ]
          ]
        },
        {
          ObjectId: 2.5.29.19 Criticality=true
          BasicConstraints:[
            CA:true
            PathLen:0
          ]
        },
        {
          ObjectId: 2.5.29.31 Criticality=false
          CRLDistributionPoints [
            [DistributionPoint:
               [URIName: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl]
          ]]
        },
        {
          ObjectId: 2.5.29.32 Criticality=false
          CertificatePolicies [
            [CertificatePolicyId: [2.5.29.32.0]
          [PolicyQualifierInfo: [
            qualifierID: 1.3.6.1.5.5.7.2.1
            qualifier: 0000: 16 1C 68 74 74 70 73 3A   2F 2F 77 77 77 2E 64 69  ..https://www.di
          0010: 67 69 63 65 72 74 2E 63   6F 6D 2F 43 50 53        gicert.com/CPS
  
          ]]  ]
          ]
        },
        {
          ObjectId: 2.5.29.37 Criticality=false
          ExtendedKeyUsages [
            serverAuth
            clientAuth
          ]
        },
        {
          ObjectId: 2.5.29.15 Criticality=true
          KeyUsage [
            DigitalSignature
            Key_CertSign
            Crl_Sign
          ]
        },
        {
          ObjectId: 2.5.29.14 Criticality=false
          SubjectKeyIdentifier [
          KeyIdentifier [
          0000: E7 01 FC 0C 16 18 CA 7D   B2 8C EC 87 27 A3 6F 61  ............'.oa
          0010: 81 3B 84 39                                        .;.9
          ]
          ]
        }
      ]},
    "certificate" : {
      "version"            : "v3",
      "serial number"      : "02 AC 5C 26 6A 0B 40 9B 8F 0B 79 F2 AE 46 25 77",
      "signature algorithm": "SHA1withRSA",
      "issuer"             : "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US",
      "not before"         : "2006-11-09 19:00:00.000 EST",
      "not  after"         : "2031-11-09 19:00:00.000 EST",
      "subject"            : "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US",
      "subject public key" : "RSA",
      "extensions"         : [
        {
          ObjectId: 2.5.29.35 Criticality=false
          AuthorityKeyIdentifier [
          KeyIdentifier [
          0000: B1 3E C3 69 03 F8 BF 47   01 D4 98 26 1A 08 02 EF  .&gt;.i...G...&amp;....
          0010: 63 64 2B C3                                        cd+.
          ]
          ]
        },
        {
          ObjectId: 2.5.29.19 Criticality=true
          BasicConstraints:[
            CA:true
            PathLen:2147483647
          ]
        },
        {
          ObjectId: 2.5.29.15 Criticality=true
          KeyUsage [
            DigitalSignature
            Key_CertSign
            Crl_Sign
          ]
        },
        {
          ObjectId: 2.5.29.14 Criticality=false
          SubjectKeyIdentifier [
          KeyIdentifier [
          0000: B1 3E C3 69 03 F8 BF 47   01 D4 98 26 1A 08 02 EF  .&gt;.i...G...&amp;....
          0010: 63 64 2B C3                                        cd+.
          ]
          ]
        }
      ]}
  ]
  )
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.906 EDT|ECDHServerKeyExchange.java:538|Consuming ECDH ServerKeyExchange handshake message (
  "ECDH ServerKeyExchange": {
    "parameters": {
      "named group": "secp256r1"
      "ecdh public": {
        0000: 04 31 BC 31 72 C2 55 60   9A D9 B9 E4 3E B5 2D DD  .1.1r.U`....&gt;.-.
        0010: D3 26 BA 6C 89 3C 67 B4   AF D7 47 1E 2B 4A A8 A3  .&amp;.l.&lt;g...G.+J..
        0020: 20 BE AA 4B 14 4C C5 4C   05 E7 A3 A5 B3 D2 73 69   ..K.L.L......si
        0030: 2D 2D AF 83 68 05 D2 FB   D6 D2 45 A3 5E 09 14 81  --..h.....E.^...
        0040: A0                                                 .
      },
    },
    "digital signature":  {
      "signature algorithm": "rsa_pss_rsae_sha256"
      "signature": {
        0000: 8A 2A 47 7E 26 BC E8 57   83 9B 39 33 36 9A DE 9E  .*G.&amp;..W..936...
        0010: A3 77 8D 57 DB 3E 11 8D   12 3C 39 71 B2 AF 2F B7  .w.W.&gt;...&lt;9q../.
        0020: 67 8F 5F C2 41 62 FC AA   CF 1A 47 6A 2F 62 7B C9  g._.Ab....Gj/b..
        0030: 52 7B 36 A9 3A 9E 49 8F   6C 2C 64 25 90 DA 49 01  R.6.:.I.l,d%..I.
        0040: 8E C7 44 5D 8D 4B 35 E3   BF 9C 3E 39 2B B1 07 E8  ..D].K5...&gt;9+...
        0050: 30 10 D9 45 74 4F 0F F6   D4 91 B1 C2 E5 D6 CE 40  0..EtO.........@
        0060: 87 61 59 F4 02 19 FB 3D   0C 17 C0 64 52 97 BD B2  .aY....=...dR...
        0070: E6 37 6C C2 5F 87 18 C3   F3 47 8C 49 96 C7 18 B0  .7l._....G.I....
        0080: 1D F4 7C D3 18 40 57 67   1F A8 2B FB BA F4 6C CA  .....@Wg..+...l.
        0090: C7 76 DA 42 EC 4D E3 36   1B 80 54 E7 02 12 BB F4  .v.B.M.6..T.....
        00A0: BF C4 40 74 B5 9C FF E9   11 65 1D DE CE CA 7A 8C  ..@t.....e....z.
        00B0: 64 BA E8 EC 7D FA 4B 61   27 0C D3 F9 66 B0 EF 8E  d.....Ka'...f...
        00C0: 7D 22 9E 5E C0 4D 8D 97   0C 86 8C 66 C4 0F 2F 7A  .".^.M.....f../z
        00D0: D9 B8 DC 77 D6 3F 06 99   72 96 E7 90 87 A8 93 59  ...w.?..r......Y
        00E0: D6 C9 66 B4 1A F4 00 70   11 3F 7B 43 25 DF DF 5E  ..f....p.?.C%..^
        00F0: 36 01 63 EA E6 38 FC 92   44 47 28 65 A6 BC CD D0  6.c..8..DG(e....
      },
    }
  }
  )
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.907 EDT|CertificateRequest.java:651|Consuming CertificateRequest handshake message (
  "CertificateRequest": {
    "certificate types": [rsa_sign, ecdsa_sign, dss_sign]
    "supported signature algorithms": [ecdsa_secp256r1_sha256, ecdsa_secp384r1_sha384, ecdsa_secp512r1_sha512, ecdsa_sha1, rsa_pss_rsae_sha256, rsa_pss_rsae_sha384, rsa_pss_rsae_sha512, rsa_pkcs1_sha256, rsa_pkcs1_sha384, rsa_pkcs1_sha512, rsa_pkcs1_sha1, dsa_sha256, dsa_sha384, dsa_sha512, dsa_sha1]
    "certificate authorities": [CN=thawte EV SSL CA - G3, O="thawte, Inc.", C=US, CN=VeridBetaCA, CN=Thawte EV RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US, CN=xxx, O=xxx, C=US, EMAILADDRESS=ca@trustwave.com, CN="Trustwave Organization Validation SHA256 CA, Level 1", O="Trustwave Holdings, Inc.", L=Chicago, ST=Illinois, C=US, CN=CAcert]
  }
  )
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.908 EDT|ServerHelloDone.java:142|Consuming ServerHelloDone handshake message (
  &lt;empty&gt;
  )
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.909 EDT|CertificateMessage.java:322|Produced client Certificate handshake message (
  "Certificates": [
    "certificate" : {
      "version"            : "v3",
      "serial number"      : "00 AB 99 40 BB F9 7F 3E 8C 08 EE",
      "signature algorithm": "SHA256withRSA",
      "issuer"             : "CN=xxx, O=xxx, C=US",
      "not before"         : "2019-07-16 09:28:47.000 EDT",
      "not  after"         : "2020-07-17 09:28:47.000 EDT",
      "subject"            : "CN=xxx",
      "subject public key" : "RSA",
      "extensions"         : [
        {
          ObjectId: 2.5.29.35 Criticality=false
          AuthorityKeyIdentifier [
          KeyIdentifier [
          0000: A7 3A 44 2D 62 9A 62 31   8A 7A 4F C6 5A 3E 6C 53  .:D-b.b1.zO.Z&gt;lS
          0010: 9B 0D 3B 53                                        ..;S
          ]
          [CN=xxx, O=xxxx, C=US]
          SerialNumber: [    56940f10]
          ]
        },
        {
          ObjectId: 2.5.29.37 Criticality=false
          ExtendedKeyUsages [
            clientAuth
          ]
        },
        {
          ObjectId: 2.5.29.15 Criticality=false
          KeyUsage [
            DigitalSignature
          ]
        },
        {
          ObjectId: 2.5.29.14 Criticality=false
          SubjectKeyIdentifier [
          KeyIdentifier [
          0000: 91 16 03 00 C1 40 CC 71   9F B4 49 31 3F 52 35 F8  .....@.q..I1?R5.
          0010: 26 BF DE 8A                                        &amp;...
          ]
          ]
        }
      ]}
  ]
  )
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.911 EDT|ECDHClientKeyExchange.java:401|Produced ECDHE ClientKeyExchange handshake message (
  "ECDH ClientKeyExchange": {
    "ecdh public": {
      0000: 04 C9 F0 6F C8 66 39 3D   65 EE DA E2 7D 2C C9 FE  ...o.f9=e....,..
      0010: 23 F9 DD 13 58 E7 3C 51   9E F8 96 59 33 93 C1 23  #...X.&lt;Q...Y3..#
      0020: B6 4F 9D 04 6A 51 56 95   BA 66 3D F3 B6 3D DC 77  .O..jQV..f=..=.w
      0030: 2E 09 A9 62 E2 E8 67 FA   77 AA 98 FB 27 ED 79 A0  ...b..g.w...'.y.
      0040: 7A                                                 z
    },
  }
  )
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.938 EDT|CertificateVerify.java:743|Produced CertificateVerify handshake message (
  "CertificateVerify": {
    "signature algorithm": rsa_pss_rsae_sha256
    "signature": {
      0000: 73 BC 50 D5 9B 82 E3 75   FA 04 63 C4 F5 34 29 6D  s.P....u..c..4)m
      0010: 54 68 5C 4C 33 24 94 B8   BA A3 91 1A DB AB 5C 4C  Th\L3$........\L
      0020: E7 54 EB 31 E2 17 83 0D   CF 1C EB CD 54 7F D6 89  .T.1........T...
      0030: F4 62 38 36 10 8E 04 E5   CE 9A DB 19 13 0F 42 20  .b86..........B 
      0040: 5C 67 95 EA 58 0A C6 9F   DB 6F CF AD 76 83 02 A3  \g..X....o..v...
      0050: 7F 37 B6 E1 11 6B 76 FD   AC 80 69 1C BB B6 23 9D  .7...kv...i...#.
      0060: 8E 04 DA 74 93 31 79 73   96 06 34 71 75 39 6D 41  ...t.1ys..4qu9mA
      0070: E4 F2 CA CF 94 46 84 8B   DE E4 48 6F 98 B5 5B 35  .....F....Ho..[5
      0080: 94 F2 68 38 6F 76 2B 4A   DF CA 49 41 93 3A 85 40  ..h8ov+J..IA.:.@
      0090: CA E7 48 02 19 B9 62 13   2A 01 95 D8 D4 A9 BF 3C  ..H...b.*......&lt;
      00A0: 35 D2 B9 1D BE 99 80 61   66 EE 4C BC 6A CF 4F 38  5......af.L.j.O8
      00B0: FF 5F 63 0D F8 1E 59 06   80 70 69 81 6D 2E 38 8B  ._c...Y..pi.m.8.
      00C0: 9E E6 2B 38 50 BA A4 C5   28 5E 49 F1 F0 9F CD E5  ..+8P...(^I.....
      00D0: 48 E1 87 30 71 1F 03 DF   7C 43 BA 4A F1 F3 DD BF  H..0q....C.J....
      00E0: 1E 44 5F 90 65 3D BD 26   D2 DB 85 4A 95 D8 6D E3  .D_.e=.&amp;...J..m.
      00F0: 8E C0 C3 BD D5 7A 72 6B   85 06 1E 21 0F B1 A5 BE  .....zrk...!....
    }
  }
  )
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.941 EDT|ChangeCipherSpec.java:109|Produced ChangeCipherSpec message
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:42.942 EDT|Finished.java:395|Produced client Finished handshake message (
  "Finished": {
    "verify data": {
      0000: E6 A2 A8 D3 AC 4F 25 83   0D 69 FB 7C 
    }'}
  )
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:43.025 EDT|ChangeCipherSpec.java:143|Consuming ChangeCipherSpec message
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:43.028 EDT|Finished.java:532|Consuming server Finished handshake message (
  "Finished": {
    "verify data": {
      0000: 90 41 AD 8D 99 B6 55 2A   39 1A 42 71 
    }'}
  )
  Jul 22, 2019 8:35:43 AM okhttp3.internal.platform.Platform log
  INFO: [420 ms] secureConnectEnd: Handshake{tlsVersion=TLS_1_2 cipherSuite=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 peerCertificates=[CN=xxxx.com, O=xxx., L=Boca Raton, ST=Florida, C=US, SERIALNUMBER=8M-543, OID.1.3.6.1.4.1.311.60.2.1.2=Minnesota, OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.2.5.4.15=Private Organization, CN=Thawte EV RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US, CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US] localCertificates=[CN=xxx]}
  Jul 22, 2019 8:35:43 AM okhttp3.internal.platform.Platform log
  INFO: [420 ms] connectEnd: http/1.1
  Jul 22, 2019 8:35:43 AM okhttp3.internal.platform.Platform log
  INFO: [421 ms] connectionAcquired: Connection{xxxx:443, proxy=DIRECT hostAddress=xxxx:443 cipherSuite=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 protocol=http/1.1}
  Jul 22, 2019 8:35:43 AM okhttp3.internal.platform.Platform log
  INFO: [423 ms] requestHeadersStart
  Jul 22, 2019 8:35:43 AM okhttp3.internal.platform.Platform log
  INFO: [424 ms] requestHeadersEnd
  Jul 22, 2019 8:35:43 AM okhttp3.internal.platform.Platform log
  INFO: [424 ms] requestBodyStart
  Jul 22, 2019 8:35:43 AM okhttp3.internal.platform.Platform log
  INFO: [426 ms] requestBodyEnd: byteCount=678
  Jul 22, 2019 8:35:43 AM okhttp3.internal.platform.Platform log
  INFO: [427 ms] responseHeadersStart
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:43.078 EDT|HelloRequest.java:181|Consuming HelloRequest handshake message (
  &lt;empty&gt;
  )
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:43.079 EDT|SSLExtensions.java:256|Ignore, context unavailable extension: cookie
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:43.081 EDT|PreSharedKeyExtension.java:624|No session to resume.
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:43.081 EDT|SSLExtensions.java:256|Ignore, context unavailable extension: pre_shared_key
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:43.081 EDT|ClientHello.java:651|Produced ClientHello handshake message (
  "ClientHello": {
    "client version"      : "TLSv1.2",
    "random"              : "41 7B EE A6 BA 5B 98 1B E1 B3 B1 2E 38 64 CA 74 70 18 C0 CC 2E 6F CD E4 DA DE E9 7B 28 02 19 7F",
    "session id"          : "A0 27 C5 87 F6 86 14 9B AA 35 67 F1 09 AF 56 CF 35 DF AB 26 27 DA AB D5 B5 E8 22 CC FC 4A DA 19",
    "cipher suites"       : "[TLS_AES_128_GCM_SHA256(0x1301), TLS_AES_256_GCM_SHA384(0x1302), TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384(0xC02C), TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256(0xC02B), TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384(0xC030), TLS_RSA_WITH_AES_256_GCM_SHA384(0x009D), TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256(0xC02F), TLS_RSA_WITH_AES_128_GCM_SHA256(0x009C), TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA(0xC014), TLS_RSA_WITH_AES_256_CBC_SHA(0x0035), TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA(0xC013), TLS_RSA_WITH_AES_128_CBC_SHA(0x002F)]",
    "compression methods" : "00",
    "extensions"          : [
  
    ]
  }
  )
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:43.123 EDT|Alert.java:232|Received alert message (
  "Alert": {
    "level"      : "fatal",
    "description": "illegal_parameter"
  }
  )
  javax.net.ssl|ERROR|01|main|2019-07-22 08:35:43.125 EDT|TransportContext.java:313|Fatal (ILLEGAL_PARAMETER): Received fatal alert: illegal_parameter (
  "throwable" : {
    javax.net.ssl.SSLHandshakeException: Received fatal alert: illegal_parameter
      at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:128)
      at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)
      at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:308)
      ....
  
  )
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:43.125 EDT|SSLSocketImpl.java:1361|close the underlying socket
  javax.net.ssl|DEBUG|01|main|2019-07-22 08:35:43.125 EDT|SSLSocketImpl.java:1380|close the SSL connection (initiative)
  javax.net.ssl|WARNING|01|main|2019-07-22 08:35:43.127 EDT|SSLSocketImpl.java:1289|handling exception (
  "throwable" : {
    javax.net.ssl.SSLHandshakeException: Received fatal alert: illegal_parameter
      at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:128)
      at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)
      at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:308)
      ....
  
  )
  Jul 22, 2019 8:35:43 AM okhttp3.internal.platform.Platform log
  INFO: [517 ms] responseFailed: javax.net.ssl.SSLHandshakeException: Received fatal alert: illegal_parameter
  Jul 22, 2019 8:35:43 AM okhttp3.internal.platform.Platform log
  INFO: &lt;-- HTTP FAILED: javax.net.ssl.SSLHandshakeException: Received fatal alert: illegal_parameter
  Jul 22, 2019 8:35:43 AM okhttp3.internal.platform.Platform log
  INFO: [519 ms] connectionReleased
  Jul 22, 2019 8:35:43 AM okhttp3.internal.platform.Platform log
  INFO: [519 ms] callFailed: javax.net.ssl.SSLHandshakeException: Received fatal alert: illegal_parameter
  Exception in thread "main" java.lang.IllegalStateException: javax.net.ssl.SSLHandshakeException: Received fatal alert: illegal_parameter
      at com.clearme.platform.http.HttpClient.execute(HttpClient.java:81)
      at com.clearme.platform.http.HttpClient.post(HttpClient.java:55)
      at com.clearme.platform.http.HttpClient.post(HttpClient.java:51)
      ....
  </code></pre>