0

When I run curl on https://www.ethics.state.tx.us/data/search/lobby/TEC_LA_CSV.zip I get a

error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure

I've tried adding -2 and -3 and other things I've seen online, but nothing seems to work. How can I resolve this issue and download this file with curl.

Here is the output from curl below,

$ curl -vvvk "https://www.ethics.state.tx.us/data/search/lobby/TEC_LA_CSV.zip"
*   Trying 204.65.203.80:443...
* TCP_NODELAY set
* Connected to www.ethics.state.tx.us (204.65.203.80) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS alert, handshake failure (552):
* error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure
* Closing connection 0
curl: (35) error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure

I'm also seeing this when I try to use -2,

curl: (4) OpenSSL was built without SSLv2 support

With -3

curl: (4) OpenSSL was built without SSLv3 support
1

I had to use the super-secret, Debian/Ubuntu --ciphers DEFAULT@SECLEVEL=1

$ curl --ciphers DEFAULT@SECLEVEL=1 -vvvk "https://www.ethics.state.tx.us/data/search/lobby/TEC_LA_CSV.zip"

In our case this enables TLS1.2, negotiation of AES128-GCM-SHA256

* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / AES128-GCM-SHA256
* ALPN, server did not agree to a protocol

From irc://irc.freenode.net/#curl

01:40 < bagder> EvanCarroll: add "--ciphers DEFAULT@SECLEVEL=1"
01:41 < EvanCarroll> zomfg.
01:41 < EvanCarroll> Where is that documented.
01:41 < EvanCarroll> nice trick.
01:42 < bagder> that's debian (ubuntu?) making things hard for users by upping that seclevel in the openssl conf
01:42 < bagder> and openssl gives a crappy error message there too, not helping either

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.