Your TLS library, or the target refusing the handshake.

SSL handshake failed — TLS handshake failure through a proxy

The encrypted session could not be negotiated. Through a proxy this is usually one of two things: the proxy is not being asked to tunnel, or the target dislikes the fingerprint your client presents.

A proxy fixes part of this. If the handshake is rejected on fingerprint, the address is not what is being judged. A proxy helps only where the rejection is reputation-based and happens before the fingerprint is examined.

Get residential IPs →Web Unblocker

Why it happens

HTTPS sent to an HTTP proxy port without CONNECT.

The target requires a TLS version or cipher your client does not offer, or the reverse.

The target rejects handshakes whose fingerprint does not match a real browser — increasingly common.

A corporate MITM certificate not trusted by your client.

How to fix it

  1. Confirm the client is issuing CONNECT for HTTPS through an HTTP proxy.
  2. Try a client with a browser-shaped TLS fingerprint if the failure is target-specific.
  3. Never disable verification to make it work — that converts a diagnosable failure into a silent one.

FAQ

What does SSL handshake failed mean?›
The encrypted session could not be negotiated. Through a proxy this is usually one of two things: the proxy is not being asked to tunnel, or the target dislikes the fingerprint your client presents. Your TLS library, or the target refusing the handshake.
Why am I getting SSL handshake failed?›
HTTPS sent to an HTTP proxy port without CONNECT. The target requires a TLS version or cipher your client does not offer, or the reverse. The target rejects handshakes whose fingerprint does not match a real browser — increasingly common. A corporate MITM certificate not trusted by your client.
How do I fix SSL handshake failed?›
Confirm the client is issuing CONNECT for HTTPS through an HTTP proxy. Try a client with a browser-shaped TLS fingerprint if the failure is target-specific. Never disable verification to make it work — that converts a diagnosable failure into a silent one.
Will a proxy fix SSL handshake failed?›
If the handshake is rejected on fingerprint, the address is not what is being judged. A proxy helps only where the rejection is reputation-based and happens before the fingerprint is examined.

Other errors

CERTIFICATE_VERIFY_FAILED525407403429401502503504400408451

Stop getting SSL handshake failed

Residential IPs across 199 countries, from $7.35/GB — no commitment, no monthly plan.

Get residential IPs →