# Can't get mitmproxy to work with badly configured site
**URL:** https://discourse.mitmproxy.org/t/cant-get-mitmproxy-to-work-with-badly-configured-site/286
**Category:** help
**Created:** [January 3, 2017, 10:18pm UTC](https://discourse.mitmproxy.org/t/cant-get-mitmproxy-to-work-with-badly-configured-site/286 "2017-01-03T22:18:06Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@simcop2387](https://discourse.mitmproxy.org/u/simcop2387)
#### Post date: [January 3, 2017, 10:18pm UTC](https://discourse.mitmproxy.org/t/cant-get-mitmproxy-to-work-with-badly-configured-site/286/1 "2017-01-03T22:18:06Z")
So this started on a thread on reddit before, but I think this is going to be a better place to actually get help.
So I’m running on Debian Sid with python 3.6 and it works for everything except this site (of course it’s the one I WANT to record everything on).
I’m running it in as insecure a method as I can seem to figure out:
$ mitmproxy -a test.flows --insecure --ssl-version-server all --ssl-version-client all --ciphers-server ALL --ciphers-client ALL -p 12345
Here’s the website: [https://techinfo.toyota.com/](https://techinfo.toyota.com/)
And according to Qualys, it only supports: [https://www.ssllabs.com/ssltest/analyze.html?d=techinfo.toyota.com](https://www.ssllabs.com/ssltest/analyze.html?d=techinfo.toyota.com)
Cipher Suites (sorted by strength as the server has no preference; deprecated and SSL 2 suites at the end)
TLS\_RSA\_WITH\_DES\_CBC\_SHA (0x9) WEAK 56
TLS\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA (0xa) 112
TLS\_RSA\_WITH\_RC4\_128\_MD5 (0x4) INSECURE 128
TLS\_RSA\_WITH\_RC4\_128\_SHA (0x5) INSECURE 128
---
### Author:  [@simcop2387](https://discourse.mitmproxy.org/u/simcop2387)
#### Post date: [January 3, 2017, 10:22pm UTC](https://discourse.mitmproxy.org/t/cant-get-mitmproxy-to-work-with-badly-configured-site/286/2 "2017-01-03T22:22:06Z")
Oh, forgot the error I get back:
TlsProtocolException(‘Cannot establish TLS with [techinfo.toyota.com:443](http://techinfo.toyota.com:443) (sni: [techinfo.toyota.com](http://techinfo.toyota.com)): TlsException(“SSL handshake error: Error([(‘SSL routines’, ‘ssl3\_read\_bytes’, ‘sslv3 alert handshake failure’)],)”,)’,)
---
### Author:  [@mhils](https://discourse.mitmproxy.org/u/mhils)
#### Post date: [January 4, 2017, 4:17pm UTC](https://discourse.mitmproxy.org/t/cant-get-mitmproxy-to-work-with-badly-configured-site/286/3 "2017-01-04T16:17:50Z")
Did you try passing `--ciphers-server ALL`?
---
### Author:  [@simcop2387](https://discourse.mitmproxy.org/u/simcop2387)
#### Post date: [January 4, 2017, 9:06pm UTC](https://discourse.mitmproxy.org/t/cant-get-mitmproxy-to-work-with-badly-configured-site/286/4 "2017-01-04T21:06:13Z")
Yes with no change, you can see the complete command I was using in the top post.
---
### Author:  [@simcop2387](https://discourse.mitmproxy.org/u/simcop2387)
#### Post date: [January 9, 2017, 11:55pm UTC](https://discourse.mitmproxy.org/t/cant-get-mitmproxy-to-work-with-badly-configured-site/286/5 "2017-01-09T23:55:45Z")
I’ve managed to track this down further for anyone curious. It’s an issue with OpenSSL. 1.0.x seems to work and 1.1.x seems to not. it looks like there’s a change where the weak ciphers and other such stuff is making it hard fail without actually connecting. Still looking into what I can do about this (aside from doing everything in a VM or downgrading openssl)
---
### Author:  [@mhils](https://discourse.mitmproxy.org/u/mhils)
#### Post date: [January 10, 2017, 9:46am UTC](https://discourse.mitmproxy.org/t/cant-get-mitmproxy-to-work-with-badly-configured-site/286/6 "2017-01-10T09:46:29Z")
Thanks, this is super helpful!
I suspect this may be related to [https://www.openssl.org/docs/manmaster/man3/SSL\_CTX\_set\_security\_level.html](https://www.openssl.org/docs/manmaster/man3/SSL_CTX_set_security_level.html). Unfortunately, SSL\_CTX\_set\_security\_level is not even exposed in [cryptography](https://github.com/pyca/cryptography) yet, so attempting a fix isn’t entirely trivial. One would need to add SSL\_CTX\_set\_security\_level to cryptography [here](https://github.com/pyca/cryptography/blob/master/src/_cffi_src/openssl/ssl.py), recompile cryptography, and then call set\_security\_level in mitmproxy somewhere around [here](https://github.com/mitmproxy/mitmproxy/blob/88f3459c7d7fc44bf0e247cf7f018f8c53431e8d/mitmproxy/net/tcp.py#L567) to check if this is the actual root cause. Of course, downgrading OpenSSL is easier. 😉
---
### Author:  [@simcop2387](https://discourse.mitmproxy.org/u/simcop2387)
#### Post date: [January 11, 2017, 1:35am UTC](https://discourse.mitmproxy.org/t/cant-get-mitmproxy-to-work-with-badly-configured-site/286/7 "2017-01-11T01:35:47Z")
I could definitely see that helping in some cases. I finally got it working by using an older openssl as it appears the 1.1.0 shipped with debian is nerfed at compile time to not allow it to connect to a site configured like that. The way I went was to setup python 3.6 with pyenv on Debian Jessie without jessie-backports. I think this’ll be such a niche problem that it’s not worth time to try to work around in the project. Nobody sane should be running a site like they do (it uses FRAMES for gods sake… 🙂 ). Now I’ve just got to write a tool to dump things into a directory structure like I want now that I’ve got all the data I need to make a proper offline manual.