MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE

[iot49]

I get MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE from accessing a particular website and am hoping for suggestions for diagnosing the issue.

Example (on esp32):

import requests

URLS = [
    "https://google.com",
    "https://web.leaf49.org",
]

for url in URLS:
    try:
        r = requests.get(url)
        print(f"{url} -> status {r.status_code}, msg-len {len(r.text)}")
    except Exception as e:
        print(f"***** {url}", e)

Output:

https://google.com/ -> status 200, msg-len 55434
***** https://web.leaf49.org/ (-30592, 'MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE')

This works properly for all domains I tried, except for https://web.leaf49.org/. wget also works as expected.

$ wget https://web.leaf49.org

Any ideas what could be causing the error, and, in particular, how to diagnose the issue?

web.leaf49.org is an nginx webserver behind a cloudflare tunnel.

[Carglglz]

Any ideas what could be causing the error, and, in particular, how to diagnose the issue?

'MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE' is most likely a SSL handshake error, probably due to protocol mismatch or lack of ciphersuites supported by both the server and the client.

Could you use e.g.

$ ab -n 1 -v 3 https://web.leaf49.org/

to see what the handshake looks like?

[iot49]

That indeed points to a problem:

GET / HTTP/1.0
Host: web.leaf49.org
User-Agent: ApacheBench/2.3
Accept: */*

---
SSL/TLS Handshake [Start] before connect initialization
SSL handshake failed (1).
7987469376:error:1404B42E:SSL routines:ST_CONNECT:tlsv1 alert protocol version:/AppleInternal/Library/BuildRoots/4e1473ee-9f66-11ee-8daf-cedaeb4cabe2/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/ssl/tls13_lib.c:129:SSL alert number 70
..done
...

I guess I need to learn about ab and TLS Handshake. Thanks for the pointer, at least I have something to go by!

Bernhard