The server only supports TLS_RSA_WITH_AES_128_CBC_SHA and TLS_RSA_WITH_AES_256_CBC_SHA, which in :ssl terms would be:
iex(1)> supported = Enum.map(['TLS_RSA_WITH_AES_128_CBC_SHA', 'TLS_RSA_WITH_AES_256_CBC_SHA'], &:ssl.str_to_suite/1)
[
%{cipher: :aes_128_cbc, key_exchange: :rsa, mac: :sha, prf: :default_prf},
%{cipher: :aes_256_cbc, key_exchange: :rsa, mac: :sha, prf: :default_prf}
]
Not only are those cipher suites not enabled by default, they are not supported by :ssl unless you explicitly downgrade the TLS version to 1.1. If a newer version of TLS is active, the initial handshake message to the server will optimistically try to negotiate the newest version, and it won’t offer those old (deprecated) cipher suites.
So after running the above, this will work (using :hackney_ssl.check_hostname_opts/1 to ensure all the other options are set correctly):
iex(2)> check_hostname_opts = :hackney_ssl.check_hostname_opts('etpgpb.ru')
# ...
iex(3)> ssl_opts = Keyword.merge(check_hostname_opts, ciphers: supported, versions: [:"tlsv1.1"])
# ...
iex(3)> HTTPoison.get!("https://etpgpb.ru/procedures.json", [], ssl: ssl_opts)
%HTTPoison.Response{
#...
status_code: 200
}
