title: SSL fatal error, handshake failure 40
body: <ol>
  <li><p>Client sends the "Client Hello" msg with those ciphers included in the cipher suite.</p>
  
  <pre><code>        Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
          Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)
          Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005)
          Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a)
          Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
          Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
          Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
          Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
          Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x0032)
          Cipher Suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA (0x0038)
          Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013)
          Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004)
  </code></pre></li>
  <li><p>In the server.xml none of these ciphers appear. Here is the catalina entry:</p>
  
  <p>Connector port="4443"  SSLEnabled="true"  acceptCount="20000"  maxThreads="5000"  allowTrace="false"  scheme="https"  secure="true" clientAuth="false"  sslProtocol="TLS"  keystoreFile="/usr/local/tomcat6/conf/Default-Cert.p12"  keystoreType="PKCS12"   keystorePass="uuuuuu"    ciphers="..."</p>
  
  <p>and the ciphers are <code>SSL_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_AES_256_CBC_SHA, SSL_DHE_RSA_WITH_AES_128_CBC_SHA, SSL_DHE_RSA_WITH_AES_256_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA</code></p></li>
  </ol>
  
  <p>Server sends “Server Hello” selecting “TLS_RSA_WITH_AES_128_CBC_SHA 0x002f)” and after ~1,5 milliseconds Server sends a fatal alert (Handshake Failure (40)).</p>
  
  <p>Can we explain the handshake failure? Is this due to the fact that TLS_RSA_WITH_AES_128_CBC_SHA is not included in the client cipher list? </p>