SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

i just installed new version of gitlab, after new installation ssl is not working... it throws SSL23_GET_SERVER_HELLO:sslv3 alert handshake error. ssh is working fine. only difference i see is in old version, browser says it is using TLS 1.0 and in new version it says 1.2.

$ git clone https://gitlabserver/group/project.git Cloning into 'project'...

• Couldn't find host gitlabserver in the _netrc file; using defaults

• Adding handle: conn: 0x282d6f8

• Adding handle: send: 0

• Adding handle: recv: 0

• Curl_addHandleToPipeline: length: 1

• • Conn 0 (0x282d6f8) send_pipe: 1, recv_pipe: 0

• About to connect() to gitlabserver port 443 (#0)

• Trying gitlabserver...

• Connected to gitlabserver port 443 (#0)

• successfully set certificate verify locations:

• CAfile: c:/Users/lanid/curl-ca-bundle.crt CApath: none

• error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

• Closing connection 0 fatal: unable to access 'https://gitlabserver/group/project.git/': error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

This seems like a client issue and it's probably something like this. Can you connect to your server with a standalone curl from the same box with failing git? Check CURL options for setting SSL/TLS protocol versions.

Maybe a simple curl/git update could solve it.

Status changed to closed

For those of you who are googling the issue, the error is kind of cryptic. The problem is that the SSL Cipher suite in Nginx does not include enough ciphers for certain git clients to work properly. To fix the issue, place this into the gitlab.rb file and reconfigure/restart Gitlab: nginx['ssl_ciphers'] = "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA"

If this is a public facing Gitlab server, Remove all of the ciphers that Qualys's SSL tester says are insecure.