Laravel SSL Handshake Failed: How to Find the Cause and Fix It

The Problem

How to Fix

1. 1

   Reproduce the handshake outside Laravel

   Run the handshake from the same server or container that runs Laravel, so you test the same OpenSSL build and CA bundle:

   openssl s_client -connect api.example.com:443 -servername api.example.com

   Force a protocol version to see which ones the remote side accepts:

   openssl s_client -connect api.example.com:443 -servername api.example.com -tls1_2
   openssl s_client -connect api.example.com:443 -servername api.example.com -tls1_3

   Check which OpenSSL and cURL builds PHP itself is using, since the CLI and PHP-FPM can differ:

   php -r 'echo OPENSSL_VERSION_TEXT, PHP_EOL, curl_version()["ssl_version"], PHP_EOL;'

   If openssl s_client also breaks, the problem is the remote server, the network or protocol support, not your Laravel code. If it succeeds but Laravel does not, compare the hostname, port and CA bundle in your Laravel config.

2. 2

   Update the CA bundle PHP verifies against

   If the error mentions "certificate verify failed" or "unable to get local issuer certificate", PHP cannot find a trusted CA that signed the remote certificate. Update the system bundle:

   sudo apt install --reinstall ca-certificates

   Slim Docker images often ship without it, so install it in the image itself:

   # Dockerfile
   RUN apt-get update && apt-get install -y ca-certificates

   Check whether php.ini points PHP at a different, older bundle:

   php -i | grep -E "openssl.cafile|curl.cainfo"

   If either is set, point both at the system bundle (/etc/ssl/certs/ca-certificates.crt on Debian and Ubuntu) or remove them. If openssl s_client shows "verify error:num=20" against a public API, the remote server may be missing its intermediate certificate. That is the provider's bug to fix. Report it rather than disabling verification.

   For a private CA, such as an internal service, trust that one CA for that one client:

   Http::withOptions(['verify' => storage_path('certs/internal-ca.pem')])->get($url);

3. 3

   Fix protocol, cipher and SNI mismatches

   "sslv3 alert handshake failure" means the two sides share no protocol version or cipher suite. Check what a working client negotiates:

   curl -sv https://api.example.com -o /dev/null 2>&1 | grep -E "SSL connection|TLSv"

   OpenSSL 3, the version on Ubuntu 22.04 and later, rejects TLS 1.0, TLS 1.1 and legacy renegotiation by default. If the remote server only speaks those, the fix belongs on that server. Lowering your OpenSSL security level re-enables broken protocol versions for every connection your app makes.

   Connect by hostname, not IP address. A request to an IP sends no SNI, and servers behind Cloudflare or a shared load balancer then cannot pick a certificate and drop the handshake. The same applies to your database and Redis host settings.

   If the failure only happens on one network, look for a corporate proxy or firewall doing TLS inspection. It replaces the remote certificate with its own, which your server does not trust.

4. 4

   Match the mail port to the right scheme

   "wrong version number" from the mailer almost always means TLS on a plaintext port or the reverse. Port 465 expects TLS from the first byte (smtps). Port 587 starts in plaintext and upgrades with STARTTLS (smtp):

   MAIL_PORT=465
   MAIL_SCHEME=smtps

   MAIL_PORT=587
   MAIL_SCHEME=smtp

   In Laravel 11 and later, an empty scheme setting makes Laravel pick smtps for port 465 and smtp for every other port, so the usual mistake is an explicit smtps scheme left over on port 587. Laravel 10 and earlier configure this through the encryption setting instead. Symfony Mailer upgrades port 587 connections with STARTTLS whenever the server offers it, so no extra setting is needed for that.

5. 5

   Configure TLS for MySQL and Redis

   Managed databases from AWS, DigitalOcean, Aiven and others usually require TLS and sign their certificates with their own CA. Download the provider's CA file and point MySQL at it. The default config/database.php already reads this variable:

   DB_HOST=db.example.com
   MYSQL_ATTR_SSL_CA=/etc/ssl/certs/provider-ca.pem

   For managed Redis, switch to a rediss:// URL. Laravel maps the rediss scheme to TLS:

   REDIS_URL=rediss://default:your-password@redis.example.com:6380

   Use the hostname from your provider's dashboard, not a private IP, so the certificate matches.

How to Verify

php artisan tinker

Http::get('https://api.example.com')->status();

Mail::raw('TLS test', fn ($message) => $message->to('you@example.com'));

grep -rn "withoutVerifying\|'verify' => false\|verify_peer" app config

Prevention

Frequently Asked Questions