Indy SSL not working as expected - delphi

Question

The following code works as shown, but not with the commented out URL.
Can you see my error?
var
IdHTTP1: TIdHTTP;
sl: TStringList;
Src : string;
LHandler: TIdSSLIOHandlerSocketOpenSSL;
begin
try
IdHTTP1 := TIdHTTP.Create(nil);
try
LHandler := TIdSSLIOHandlerSocketOpenSSL.Create(nil);
try
IdHTTP1.IOHandler := LHandler;
Src := IdHTTP1.Get(TIdURI.URLEncode(
//'https://geocoding.geo.census.gov/geocoder/locations/onelineaddress?address=4600+Silver+Hill+Rd%2C+Suitland%2C+MD+20746&benchmark=9&format=json'
'https://tools.usps.com/go/ZipLookupResultsAction!input.action?resultMode=0&companyName=&address1=1600+PENNSYLVANIA+AVE+NW&address2=&city=&state=Select&urbanCode=&postalCode=&zip=20500'
));
ShowMessage(Copy(src, 1, 100));
finally
LHandler.Free;
end;
finally
IdHTTP1.Free;
end;
except
on E: Exception do
ShowMessage('e');
end;
ShowMessage('done');
end;
The commented out URL raises an exception:
EIdOSSLUnderlyingCryptoError: Error connecting with SSL. Error connecting with SSL. error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure

Answer 1

The two URLs you have shown are already url-encoded, so you should not be passing them to TIdURI.URLEncode() at all, just pass them as-is to TIdHTTP.Get(). That being said, make sure you are using an up-to-date version of Indy so that you have this bug fix to avoid double-encoding any sequences that are already percent-encoded.
In any case, the problem you are having is not related to the URL encoding. The cause of the SSL alert error is that TIdSSLIOHandlerSocketOpenSSL enables only TLS 1.0 by default, but many modern web servers are slowly moving away from TLS 1.0 and now require TLS 1.1+. geocoding.geo.census.gov won't work with anything less than TLS 1.2, whereas tools.usps.com still allows TLS 1.0. Modern web browsers support TLS 1.0+.
So the fix is to enable TLS 1.1 and TLS 1.2 in the TIdSSLIOHandlerSocketOpenSSL.SSLOptions.SSLVersions property 1.
1: I have opened a ticket in Indy's issue tracker to enable TLS 1.1+ by default in a future release.