title: Error:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
body: <pre><code>$ch = curl_init();
  $clientId = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
  $secret = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
  
  curl_setopt($ch, CURLOPT_URL, "https://api.sandbox.paypal.com/v1/oauth2/token");
  curl_setopt($ch, CURLOPT_HEADER, false);
  curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,false);
  curl_setopt($ch, CURLOPT_POST, true);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  curl_setopt($ch, CURLOPT_USERPWD, $clientId.":".$secret);
  curl_setopt($ch, CURLOPT_POSTFIELDS, "grant_type=client_credentials");
  $result = curl_exec($ch);
  if (curl_errno($ch)) {
      echo 'Error:' . curl_error($ch);
  }
  curl_close ($ch);
  </code></pre>
  
  <p>this code working on localhost but when i am testing on my live server it will give me this error <strong>Error:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure</strong> then i tried this </p>
  
  <pre><code>&lt;?php
  $ch = curl_init(); 
  curl_setopt($ch, CURLOPT_URL, "https://tlstest.paypal.com/"); 
  curl_setopt($ch, CURLOPT_CAINFO, dirname(__FILE__) . '/cacert.pem');
  var_dump(curl_exec($ch));
  if ($err = curl_error($ch)) {
  var_dump($err);
  echo "DEBUG INFORMATION:\n###########";
  echo "CURL VERSION";
  echo json_encode(curl_version(), JSON_PRETTY_PRINT);
  }?&gt;
  </code></pre>
  
  <p>github.com/paypal/TLS-update/tree/master/php this will again work on localhost and on live it gives me this </p>
  
  <pre><code>error bool(false)
  string(67) "Unknown SSL protocol error in connection to tlstest.paypal.com:443 "
  DEBUG INFORMATION:
  ###########CURL VERSION
  </code></pre>
  
  <p>my server have these certificates</p>
  
  <p><strong>Server Key and Certificate #1</strong></p>
  
  <pre><code>Subject *.secure.xxxxxxxx.com
  
  
  Fingerprint SHA1: xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  
  
  Pin SHA256: S4/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  
  
  Common names    *.secure.xxxxxxxx.com   MISMATCH
  
  
  Alternative names   *.secure.xxxxxxx.com
  
  
  
  Key RSA 2048 bits (e 65537)
  
  
  Weak key (Debian)   No
  
  
  Issuer  Symantec Class 3 Secure Server CA - G4
  
  
  AIA: xxxxxxx/ss.crt
  
  
  Signature algorithm SHA256withRSA
  
  
  Extended Validation No
  
  
  Certificate Transparency    Yes (certificate)
  
  
  OCSP Must Staple    No
  
  
  Revocation information  CRL, OCSP
  
  
  CRL: xxxxxx/ss.crl
  
  
  OCSP: xxxxxxxxx
  
  
  Revocation status   Good (not revoked)
  
  Trusted No   NOT TRUSTED (Why?)
  </code></pre>
  
  <p><strong>#2</strong></p>
  
  <pre><code>Subject Symantec Class 3 Secure Server CA - G4
  
  
  Fingerprint SHA1: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  
  
  Pin SHA256: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  
  
  Key RSA 2048 bits (e 65537)
  
  
  Issuer  VeriSign Class 3 Public Primary Certification Authority - G5
  
  
  Signature algorithm SHA256withRSA
  </code></pre>
  
  <p><strong>#3</strong></p>
  
  <pre><code>Subject VeriSign Class 3 Public Primary Certification Authority - G5
  
  
  Fingerprint SHA1: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  
  
  Pin SHA256: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  
  Key RSA 2048 bits (e 65537)
  
  
  Issuer  VeriSign, Inc. / Class 3 Public Primary Certification Authority
  
  Signature algorithm SHA1withRSA   WEAK
  
  **Protocols**
  
  
  TLS 1.2 Yes
  
  
  TLS 1.1 Yes
  
  
  TLS 1.0 Yes
  
  
  SSL 3   No
  
  
  SSL 2   No
  </code></pre>
  
  <p><img src="https://i.stack.imgur.com/CWs28.png" alt="enter image description here"></p>
  
  <p><strong>checked requirements <a href="https://www.paypal-knowledge.com/infocenter/index?page=content&amp;id=FAQ1766&amp;expand=true&amp;locale=en_US" rel="nofollow noreferrer">at</a></strong></p>