Hello,

The other day, we had a Scrapy user report an issue connecting to https://www.skelbiu.lt/ with OpenSSL 1.1 [1]

To not mix scrapy's things with Twisted Web, I used this (adapted from official docs):

#---------------
from __future__ import print_function

from twisted.internet import reactor
from twisted.web.client import Agent
from twisted.web.http_headers import Headers

agent = Agent(reactor)

d = agent.request(
    'GET',
    'https://www.skelbiu.lt/',
    Headers({'User-Agent': ['Twisted Web Client Example']}),
    None)

def cbResponse(ignored):
    print('Response received')
d.addCallback(cbResponse)

def cbShutdown(ignored):
    print(ignored)
    reactor.stop()
d.addBoth(cbShutdown)

reactor.run()
#---------------

And I did get a Handshake failure too:

    $ python twistedtest.py
    [Failure instance: Traceback (failure with no frames): <class 'twisted.web._newclient.ResponseNeverReceived'>: [<twisted.python.failure.Failure OpenSSL.SSL.Error: [('SSL routines', 'ssl3_read_bytes', 'sslv3 alert handshake failure')]>]
    ]


It seems this happens (at least) with OpenSSL 1.1.0e (currently in Debian 9 sid [2])
It does not happen (for me) with OpenSSL 1.0.2g for example.

I dug into this this afternoon and narrowed it down to the use of