Thanks for the reply. I’m able to use HTTPoison to connect to https://www.google.com as well as another personal https site I have. So I don’t suspect the installation is the culprit. I’m using HTTPS URLs and the responses from the servers indicate that the client is going to the right port.
Here’s the nmap dump of ciphers to the problem service. That list seems kind of skimpy, but I’ve only looked at a few other sites for comparison:
% nmap --script ssl-enum-ciphers -p 443 api.etrade.com 14:30:49
Starting Nmap 7.91 ( https://nmap.org ) at 2021-01-20 14:34 EST
Nmap scan report for api.etrade.com (12.153.224.50)
Host is up (0.027s latency).
Other addresses for api.etrade.com (not scanned): 198.93.34.32
rDNS record for 12.153.224.50: mtrader.etrade.com
PORT STATE SERVICE
443/tcp open https
| ssl-enum-ciphers:
| TLSv1.2:
| ciphers:
| TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
| TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
| TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
| TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
| TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
| TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
| compressors:
| NULL
| cipher preference: server
| warnings:
| Forward Secrecy not supported by any cipher
|_ least strength: A
Here is a naive attempt to connect to the api URL:
iex(3)> HTTPoison.get!("https://api.etrade.com")
[info] TLS :client: In state :hello received SERVER ALERT: Fatal - Handshake Failure
** (HTTPoison.Error) {:tls_alert, {:handshake_failure, 'TLS client: In state hello received SERVER ALERT: Fatal - Handshake Failure\n'}}
(httpoison 1.8.0) lib/httpoison.ex:156: HTTPoison.request!/5
Adding a tlsv1.2 option doesn’t seem to change anything. Neither does the suggested log_level: :debug. The output was exactly the same.
iex(4)> HTTPoison.get!("https://api.etrade.com", [], [ssl: [versions: [:'tlsv1.2']], log_level: :debug])
I’m using the 1.8 version of HTTPoison. How do I see what ciphers it (or Hackney) has available?
Followup edit: I think I see the ciphers offered up by the client in the wireshark capture I just did. HTTPoison or Hackney or whatever offers no TLS_RSA_WITH_AES* cipher suites. Meanwhile, a packet capture of a successful curl negotiation includes plenty that match those available on the server.
What can I do about it?
Thank you for any advice.
