Diagnosing TLS Handshake Failures Between Internal Services

Act as a helpful guide for platform engineers troubleshooting secure communication issues. Your goal is to walk a beginner through diagnosing common TLS handshake failures between internal services.

### Context
You're seeing a TLS handshake error when `{{failing_service_name}}` tries to talk to `{{peer_service_name}}`. The error messages aren't very clear, but often these problems come from issues with certificates, how services identify themselves (SNI), or incompatible security settings (cipher suites).

### Task
Create a simple, step-by-step debugging guide. For each common problem area, give clear checks to run, what commands to use (like `openssl` or `curl`), what results to look for, and how to fix it.

### Focus Areas
Stick to checking:
*   Certificate chain validation (making sure certificates are trusted)
*   SNI (Server Name Indication) issues (service identity)
*   Cipher suite mismatches (agreeing on encryption methods)

### Guide Structure
Organize your guide like this for each issue:
*   **Symptom**: What you see.
*   **Hypothesis**: What might be wrong.
*   **Checks (with commands)**: How to find out, with specific commands and what to expect.
*   **Likely Fixes**: How to solve it.
*   **Verification**: How to confirm it's fixed.

As a seasoned network diagnostics expert specializing in secure communications, your role is to guide a platform engineer through a common yet complex issue: TLS handshake failures between internal services.

### Context
A platform engineer is encountering a persistent TLS handshake failure between two internal microservices: `{{failing_service_name}}` and `{{peer_service_name}}`. The error logs indicate a generic TLS handshake failure, without specific root causes. The engineer suspects issues related to certificate chain validation, Server Name Indication (SNI) mismatches, or cipher suite incompatibilities, common culprits in mTLS environments.

### Task
Generate a comprehensive debugging playbook. This playbook should systematically address the most common hypotheses for TLS handshake failures in an internal service context. For each hypothesis, provide specific diagnostic checks, including command-line tools and expected outputs, along with likely fixes and verification steps.

### Constraints
*   **Focus Areas**: The playbook must specifically cover certificate chain validation, SNI issues, and cipher suite mismatches. Do not deviate into other networking issues unless directly related to these TLS aspects.
*   **Practical Checks**: Each diagnostic check must include actionable command-line examples, assuming a Linux environment (e.g., `openssl`, `curl`, `ss`, `netstat`, `tcpdump`).
*   **Output Structure**: The playbook must follow the exact structure: `Symptom` 
 `Hypothesis List` 
 `Checks (with commands)` 
 `Likely Fixes` 
 `Verification`.
*   **Clarity**: Ensure the language is precise, diagnostic, and avoids ambiguity.
*   **No Generic Advice**: Provide concrete steps and commands, not high-level suggestions.

### Output Format
The output must be a markdown-formatted debug playbook with the following sections for each major hypothesis:

1.  **Symptom**: Brief description of the observed failure.

2.  **Hypothesis List**:
    *   Hypothesis 1: `[Specific issue, e.g., Mismatched Certificate Chain]`
    *   Hypothesis 2: `[Specific issue, e.g., SNI Mismatch]`
    *   Hypothesis 3: `[Specific issue, e.g., Incompatible Cipher Suites]`
    *   ...

3.  **Checks (with commands)**:
    *   **Check for Hypothesis 1**: `[Description of check]`
        *   `[Command-line example]`
        *   `[Expected output / interpretation]`
    *   **Check for Hypothesis 2**: `[Description of check]`
        *   `[Command-line example]`
        *   `[Expected output / interpretation]`
    *   ...

4.  **Likely Fixes**:
    *   **Fix for Hypothesis 1**: `[Actionable solution]`
    *   **Fix for Hypothesis 2**: `[Actionable solution]`
    *   ...

5.  **Verification**:
    *   `[Steps to confirm resolution, e.g., re-running service, checking logs]`

Generate a focused debugging playbook for a platform engineer experiencing TLS handshake failures between `{{failing_service}}` and `{{peer_service}}`. As a network expert, create a concise guide covering certificate chain validation, SNI issues, and cipher suite mismatches. For each, provide a specific diagnostic check with a command-line example (e.g., `openssl`, `curl`), expected output, a likely fix, and a verification step. Structure the output as: Symptom, Hypothesis List, Checks (with commands), Likely Fixes, and Verification, ensuring all advice is practical and command-line driven for Linux environments.

As a Principal Security Architect specializing in mTLS and incident response, guide a platform engineer and relevant stakeholders through a critical TLS handshake failure between `{{failing_service_name}}` and `{{peer_service_name}}`. This failure impacts critical internal service communication and requires a structured, auditable approach.

### Context
A platform engineer has reported a persistent TLS handshake failure, with generic logs. Initial suspicions point to certificate chain, SNI, or cipher suite issues, which are common in our mTLS framework. The resolution process must account for security best practices, compliance requirements, and potential audit trails.

### Task
Develop a comprehensive debugging and incident response playbook. This playbook must systematically address the identified TLS failure hypotheses, providing technical diagnostic steps alongside considerations for documentation, stakeholder communication, and compliance.

### Constraints
*   **Technical Scope**: Strictly adhere to certificate chain, SNI, and cipher suite issues.
*   **Auditability**: All diagnostic checks and fixes must be documented in a way that supports post-incident review.
*   **Communication**: Include prompts for informing security, compliance, and service owners.
*   **Risk Assessment**: Briefly note potential impact of prolonged failure.
*   **Practical Checks**: Include command-line examples (Linux: `openssl`, `curl`, `tcpdump`).
*   **Output Structure**: Follow: `Symptom` 
 `Hypothesis List` 
 `Checks (with commands) & Audit Notes` 
 `Likely Fixes & Compliance Steps` 
 `Verification & Incident Closure`.

### Output Format
A markdown-formatted debug and incident response playbook, structured as specified, emphasizing clear, actionable steps and enterprise-level considerations for each hypothesis.