Debian 11 in August raised the default OpenSSL security level, and connections that had worked for years started failing with an unhelpful handshake error.
$ curl https://legacy-partner.example/api
curl: (35) error:0A00014D:SSL routines::legacy sigalg
disallowed or unsupported
$ openssl s_client -connect legacy-partner.example:443 2>&1
| grep -E 'Protocol|Cipher'
Protocol : TLSv1.2
Cipher : ECDHE-RSA-DES-CBC3-SHA
# SECLEVEL=1 in openssl.cnf restores it, globally,
# for everything — which is the problem.The default moved from security level 1 to 2, which disallows SHA-1 signatures and keys below 2048 bits. Lowering it system-wide to reach one legacy partner weakens every other connection the host makes, so the containable version is a per-process configuration file pointed at with OPENSSL_CONF, or better, a conversation with the partner. The error text is genuinely unhelpful and does not mention the security level at all, which is why this cost people an afternoon each.