Hello. The analysis above is correct - it is due to how OpenSSL 0.9.8 handles (mishandles) warning-level alerts in SSL23 mode.

I submitted a fix to OpenSSL for their review which you can track [here](http://marc.info/?l=openssl-dev&m=136760073921954&w=2).

---
** [bugs:#1037] SSL23_GET_SERVER_HELLO when connecting to OpenSSL 1.0.0**
**Status:** closed
**Labels:** https 
**Created:** Sun Aug 21, 2011 12:09 AM UTC by Jan-E
**Last Updated:** Thu Dec 13, 2012 10:04 AM UTC
**Owner:** Daniel Stenberg
Same behaviour as in the closed bug 3165773.
Additional info: fails when connectiing to https://www.domain.tld, but connects correctly to https://domain.tld
E:\utils>curl --version
curl 7.19.4 \(i386-pc-win32\) libcurl/7.19.4 OpenSSL/0.9.8j zlib/1.2.3 libidn/1.11 libssh2/1.0
Protocols: tftp ftp telnet dict ldap http file https ftps scp sftp
Features: IDN Largefile NTLM SSL SSPI libz
E:\utils>curl -k -I https://sessionportal.net/
HTTP/1.1 200 OK
Date: Sat, 20 Aug 2011 23:59:23 GMT
Server: Apache/2.2.19 \(Win32\) DAV/2 mod\_fcgid/2.3.6 mod\_ssl/2.2.19 OpenSSL/1.0.0d PHP/5.3.6
\[snip\]
E:\utils>curl -k -I https://www.sessionportal.net/
curl: \(35\) error:14077458:SSL routines:SSL23\_GET\_SERVER\_HELLO:reason\(1112\)
---
Sent from sourceforge.net because you indicated interest in <https://sourceforge.net/p/curl/bugs/1037/>
To unsubscribe from further messages, please visit <https://sourceforge.net/auth/subscriptions/>