https://archive.md/bw2cN
(Its a medium page that doesn't load for me)
(Its a medium page that doesn't load for me)
Sometimes I wish there was a way to tell our browsers "I really don't care about SSL on this page, honestly, and I'm qualified to tell when it matters."
SSL version or cipher mismatch can be from other causes. For example, the server might be responding with a html page that your browser is interpreting as https or vice versa, such as if the developers run http for local dev and https for prod and something gets confused.
No, it's speaking TLS; it (the server) sends a TLS fatal alert & disconnects immediately after the ClientHello.
It's odd, too; I asked nmap to show what ciphersuites the server offers, and it seems like what nmap was able to elicit indicates there is overlap between what's offered by the client and the server. So … IDK what is going on here. (It seems like the server isn't doing cipher suite negotiation correctly, AFAICT. The server-offered cipher suite set is a bit … unusual looking? E.g., no DHE, but ECDHE, but also non-DHE?)
On your client, maybe the person getting this is just out of date? (Or are you getting the same thing?)
But I can see in Wireshark FF's ClientHello, and some of the cipher suites in that ClientHello seem to appear in the output that nmap says is the server's available cipher suites. So, I am perplexed.
(And I'm on Arch; my FF can't be too far behind.)
Also, perhaps disable keyboard entry so you can't type a password in without acknowledging that you probably aren't visiting the site you think you are.