# Java: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

**Code:** `Received fatal alert: handshake_failure` · **Category:** SSL / TLS · **Seen on:** SSL, Java

The server rejected the Java client's TLS offer — no shared protocol/cipher, SNI issue or a required client certificate.

## Meaning

Run with `-Djavax.net.debug=ssl:handshake` to see the ClientHello and the alert. Old JDKs (Java 7 default TLS 1.0) can't talk to TLS 1.2-only servers; new JDKs disable weak algorithms (`jdk.tls.disabledAlgorithms`) that old servers still use. Upgrade or align both sides.

## Common causes

- Old JDK without TLS 1.2 by default
- Server demands a client certificate
- Disabled algorithms (TLS 1.0/1.1, 3DES) in new JDK
- SNI not sent (rare)
- Weak DH key rejected

## Quick fix

1. Enable debug: `-Djavax.net.debug=ssl:handshake`
2. Use a modern JDK and TLS 1.2+
3. Provide the keystore for mTLS: `-Djavax.net.ssl.keyStore=...`

## Detailed fix by platform

### Linux

1. `java -Djavax.net.debug=ssl:handshake -jar app.jar 2>&1 | head -100`

## How to diagnose

1. **Debug** — ClientHello vs server alert?
2. **JDK** — Version?
3. **mTLS** — Required?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/ssl/java-received-fatal-alert-handshake-failure)