Offer separate error during handshakes.

It's useful to know that an error was specific to the TLS handshake,
versus the TCP connect, or a later stage of a request.

src/stream.rs

@@ -1,4 +1,5 @@
 use log::debug;
+use rustls::Session;
 use std::io::{self, BufRead, BufReader, Read, Write};
 use std::net::SocketAddr;
 use std::net::TcpStream;
@@ -349,10 +350,14 @@ pub(crate) fn connect_https(unit: &Unit, hostname: &str) -> Result<Stream, Error
         .as_ref()
         .map(|c| &c.0)
         .unwrap_or(&*TLS_CONF);
-    let sess = rustls::ClientSession::new(&tls_conf, sni);
-
-    let sock = connect_host(unit, hostname, port)?;
+    let mut sock = connect_host(unit, hostname, port)?;
+    let mut sess = rustls::ClientSession::new(&tls_conf, sni);
 
+    sess.complete_io(&mut sock).map_err(|err| {
+        ErrorKind::ConnectionFailed
+            .msg("error during TLS handshake. Sometimes this means the host doesn't support any of the same ciphersuites as rustls, or doesn't support TLS 1.2 and above")
+            .src(err)
+    })?;
     let stream = rustls::StreamOwned::new(sess, sock);
 
     Ok(Stream::from_tls_stream(stream))