From 671f24ab49c03e9279f1bc10dc9d69377d02ce75 Mon Sep 17 00:00:00 2001
From: Jacob Hoffman-Andrews <github@hoffman-andrews.com>
Date: Sun, 21 Feb 2021 11:14:50 -0800
Subject: [PATCH 1/2] Offer separate error during handshakes.

It's useful to know that an error was specific to the TLS handshake,
versus the TCP connect, or a later stage of a request.
---
 src/stream.rs | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/src/stream.rs b/src/stream.rs
index 5850066..b491fdd 100644
--- a/src/stream.rs
+++ b/src/stream.rs
@@ -1,4 +1,5 @@
 use log::debug;
+use rustls::Session;
 use std::io::{self, BufRead, BufReader, Read, Write};
 use std::net::SocketAddr;
 use std::net::TcpStream;
@@ -349,10 +350,14 @@ pub(crate) fn connect_https(unit: &Unit, hostname: &str) -> Result<Stream, Error
         .as_ref()
         .map(|c| &c.0)
         .unwrap_or(&*TLS_CONF);
-    let sess = rustls::ClientSession::new(&tls_conf, sni);
-
-    let sock = connect_host(unit, hostname, port)?;
+    let mut sock = connect_host(unit, hostname, port)?;
+    let mut sess = rustls::ClientSession::new(&tls_conf, sni);
 
+    sess.complete_io(&mut sock).map_err(|err| {
+        ErrorKind::ConnectionFailed
+            .msg("error during TLS handshake. Sometimes this means the host doesn't support any of the same ciphersuites as rustls, or doesn't support TLS 1.2 and above")
+            .src(err)
+    })?;
     let stream = rustls::StreamOwned::new(sess, sock);
 
     Ok(Stream::from_tls_stream(stream))

From 413e8bf4aadaf73ef6dc8ce659f548ba31d74646 Mon Sep 17 00:00:00 2001
From: Jacob Hoffman-Andrews <github@hoffman-andrews.com>
Date: Sun, 21 Feb 2021 13:32:42 -0800
Subject: [PATCH 2/2] Fix imports

---
 src/stream.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/stream.rs b/src/stream.rs
index b491fdd..4a36cbb 100644
--- a/src/stream.rs
+++ b/src/stream.rs
@@ -1,5 +1,4 @@
 use log::debug;
-use rustls::Session;
 use std::io::{self, BufRead, BufReader, Read, Write};
 use std::net::SocketAddr;
 use std::net::TcpStream;
@@ -331,6 +330,7 @@ fn configure_certs(config: &mut rustls::ClientConfig) {
 #[cfg(feature = "tls")]
 pub(crate) fn connect_https(unit: &Unit, hostname: &str) -> Result<Stream, Error> {
     use once_cell::sync::Lazy;
+    use rustls::Session;
     use std::sync::Arc;
 
     static TLS_CONF: Lazy<Arc<rustls::ClientConfig>> = Lazy::new(|| {