> Source: [sk112954](https://support.checkpoint.com/results/sk/sk112954)

# sk112954 - Some HTTPS sites do not load when HTTPS Inspection is enabled, if TLS 1.2 with ECDHE cipher is used

| Property | Value |
|----------|-------|
| Solution ID | sk112954 |
| Date Created | 2016-08-18 |
| Last Modified | 2019-09-03 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |
| Platform | 400 |

## Symptoms

- * Some HTTPS sites do not load when HTTPS Inspection is enabled, if TLS 1.2 with ECDHE cipher is used.

* Debug of WSTLSD daemon (per [sk105559](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk105559)) on Security Gateway shows that HTTPS site sends TLS handshake failure:

  `
  cptls_handle_msg: called. msg=HS_EVENT_HANDLER`  
  `
  cptls_handle_msg: kernel_instance: 3`  
  `
  cptls_handle_msg: conn_id: 0x...`  
  `
  cptls_ChannelTable::handleMsg: kernel instance: ...`  
  `
  cptls_ChannelTable::handleMsg: channel conn_id: 0x...`  
  `
  cptls_ActiveProxy::event_handler: called.`  
  `
  cptls_ProxyChannel::saveClientMsg: conn_id: 0x...`  
  `
  cptls_ProxyChannel::isSavingClientMsg: checking conn_id: 0x...`  
  `
  cptls_ProxyChannel::isSavingClientMsg: server side. not saving`  
  `
  cptls_ProxyChannel::saveClientMsg: nothing to do.`  
  `
  cptls_ProxyChannel::isConnSuspended: no.`  
  `
  cptls_ProxyChannel::event_handler: called.`  
  `
  cptls_ProxyChannel::getHS: conn_id matches server side: 0x...`  
  `
  cptls_hs_event_handler: called`  
  `
  cptls_hs_event_handler: called from kernel instance: ...`  
  `
  cptls_hs_event_handler: conn_id: 0x...`  
  `
  cptls_hs_event_handler: event CPTLS_HS_ALERT, buf_len = ...`  
  `
  cptls_hs_print_alert: alert level: CPTLS_fatal, description: CPTLS_handshake_failure(40).`  
  `
  cptls_hs_message_handler: called`  
  `
  CLN_handle_alert: called.`  
  `
  cptls_hs_record_alert: called. alert level: CPTLS_fatal description: CPTLS_handshake_failure
  `

## Cause

The HTTPS site, to which the connection fails, requires the following in the TLS communication:

* The TLS "`ec_point_formats`" extension (Supported Point Formats Extension - [RFC 4492](https://tools.ietf.org/html/rfc4492)) to be sent in the "ClientHello" together with TLS "`elliptic_curves`" extension (Supported Elliptic Curves Extension - [RFC 4492](https://tools.ietf.org/html/rfc4492)).

* The TLS Renegotiation Indication information to be sent as TLS Renegotiation Indication Extension ([RFC 5746](https://tools.ietf.org/html/rfc5746)) and not as special value in ciphers list.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content