Skip to content

Troubleshooting TLS Handshake Failures

To diagnose why a TLS connection is not completing, enable the JVM's built-in SSL/TLS debug logging on the QIE service: add the JVM option -Djavax.net.debug=ssl,handshake to the QIE Service Manager's Java tab and restart QIE. The verbose handshake log appears in qie.log (or in the server's standard output) and includes:

  • The ClientHello and ServerHello records (negotiated protocol version and cipher suite).
  • The server's certificate chain.
  • The client's certificate (for mutual TLS).
  • The key-exchange and Finished messages.

Read top-to-bottom; the first error or aborted-handshake message identifies the failure point. Common patterns:

  • no cipher suites in common means the client and server cannot agree; see Disabling TLS Protocol Versions and the Override cipher suites for this connection option on the inbound listener.
  • unable to find valid certification path means the server's certificate is not trusted; import the issuer (or self-signed) certificate via this Certificate Management page.
  • certificate_unknown means the client (in mutual TLS) did not present a certificate the server trusts.

Disable the option after troubleshooting. The debug logs are verbose and noisy.