> Source: [sk180807](https://support.checkpoint.com/results/sk/sk180807)

# sk180807 - macOS does not connect to the on-premises Endpoint server with FQDN

| Property | Value |
|----------|-------|
| Solution ID | sk180807 |
| Date Created | 2023-03-30 |
| Last Modified | 2023-04-01 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | R81.10 (EOS) |
| OS | macOS |

## Symptoms

- * Endpoint Security Client E87.30 macOS does not connect to server using FQDN.
* **cp_da.log:**   
  TLS protocol sent TLS error: handshake failure cpdaApp: (libboringssl.dylib) \[com.apple.network:boringssl\] boringssl_session_handshake_error_print(41) \[C536.1:2\]\[0x7fbf42f11e10\] Error: 140459438564968:error:10000410:SSL routines:OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE:/AppleInternal/Library/BuildRoots/f93a3176-3a83-11ed-8157-ca9c01dc79de/Library/Caches/com.apple.xbs/Sources/boringssl/ssl/tls_record.cc:594:SSL alert number 40 cpdaApp: (libboringssl.dylib) \[com.apple.network:boringssl\] boringssl_session_handshake_error_print(41) \[C536.1:2\]\[0x7fbf42f11e10\] Error: 140459438564968:error:1000009a:SSL routines:OPENSSL_internal:HANDSHAKE_FAILURE_ON_CLIENT_HELLO:/AppleInternal/Library/BuildRoots/f93a3176-3a83-11ed-8157-ca9c01dc79de/Library/Caches/com.apple.xbs/Sources/boringssl/ssl/handshake.cc: cpdaApp: (libboringssl.dylib) \[com.apple.network:boringssl\] nw_protocol_boringssl_handshake_negotiate_proceed(757) \[C536.1:2\]\[0x7fbf42f11e10\] handshake failed at state 12288: not completed
* **cpdaApp.logs:**   
  No cached host name, evaluating hostname based on host names in server settings and available client network interfaces. DEBUG \[\*CServer::getHostname\] Fqdn found (), measure response time ERROR \[-\[VerifyCertificateDelegate URLSession:task:didCompleteWithError:\]\] request failed with error: The request timed out
* **cpda.log:**   
  Error 0x0 15235 0 cpdaApp: (CFNetwork) Task .\<1\> finished with error \[-1009\] Error Domain=NSURLErrorDomain Code=-1009 UserInfo={_kCFStreamErrorCodeKey=50, NSUnderlyingError=0x6000033cdcb0 {Error Domain=kCFErrorDomainCFNetwork Code=-1009 UserInfo={_NSURLErrorNWPathKey=satisfied (Path is satisfied), viable, interface: en0, ipv4, dns, _kCFStreamErrorCodeKey=50, _kCFStreamErrorDomainKey=1}}, _NSURLErrorFailingURLSessionTaskErrorKey=, _NSURLErrorRelatedURLSessionTaskErrorKey=, NSLocalizedDescription=, NSErrorFailingURLStringKey=, NSErrorFailingURLKey=, _kCFStreamErrorDomainKey=1} Info 0x0 15235 0 cpdaApp: (libnetwork.dylib) \[com.apple.network:\] nw_context_dealloc Deallocating context

## Cause

The macOS feature known as Apple ATS (Application Transport Security) imposes limitations on the cipher suites that are sent by the client in TLS `ClientHello` when using the FQDN on the HTTP request API that we use.  
When the IP address is used instead of the FQDN in the request API, the TLS handshake is successful.  

When ATS is used with a FQDN in the URL, the macOS client does not send the cipher suites that the on-premises server supports in the `clienthello`. It is important to note that the on-premises server only supports two cipher suites.   

\| ` TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A`  

\| `TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A`  

`TLS_RSA_WITH_AES_256_CBC_SHA `cipher is used to communicate with the server, but the macOS client does not include this cipher in "Client Hello".  

This is a list of supported ciphers that client sends in "Client Hello". (`TLS_RSA_WITH_AES_256_CBC_SHA` is not included):  

Cipher Suites (14 suites)  
`Cipher Suite: Reserved (GREASE) (0x9a9a)`  
` Cipher Suite: TLS_AES_128_GCM_SHA256 (0x1301)`  
` Cipher Suite: TLS_AES_256_GCM_SHA384 (0x1302)`  
` Cipher Suite: TLS_CHACHA20_POLY1305_SHA256 (0x1303)`  
` Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)`  
` Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)`  
` Cipher Suite: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)`  
` Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)`  
` Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)`  
` Cipher Suite: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)`  
` Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)`  
` Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)`  
` Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)`  
` Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)`

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) file from the Security Gateway / each Cluster Member involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content