SSL is a complex protocol with many options. The client and the server need to negociate to select compatible options. This is made especially difficult because one of the objectives of SSL is to protect against a man-in-the-middle attack and one of the possible methods of attack is to perturb the negociation — which has to happen before secure communication is established — in order to force insecure parameters.
SSLv3 is an obsolete version of the protocol. Today TLS 1.2 is preferred, 1.0 is ok (as is 1.1, but it's rare in practice). If the negociation goes down to SSLv3, either the server is seriously outdated or something went wrong (probably because the server is badly configured).
A useful tool to get more information about what's going on is Wireshark. Tell it to record TCP traffic to 1.1.1.1 on port 443 with the filter host 1.1.1.1 and port 443
. Wireshark should automatically detect the connection as SSL and will display a detailed analysis of each message. In the SSL connection, the client first sends a “client hello” message which indicates what settings it supports, and the server replies with a “server hello” that makes a selection among the client's supported settings. Here it seems that the server has selected something that the client doesn't support, causing a protocol downgrade.
curl --cipher DES-CBC3-SHA http://...
. It might be that this cipher is disabled by default in your version of curl.openssl ciphers -v | grep DES
. I am using Arch.