Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

My clients are reporting this error. I cannot reproduce it. What's more, I cannot detect any flaws: http://www.digicert.com/ http://www.ssltest.net/ https://www.ssllabs.com/ssldb/ all report dev.anuary.com to have a valid cert. I've Google(ed) for ssl_error_no_cypher_overlap, but none of the threads provided any useful guidance.

Cannot communicate securely with peer: no common encryption algorithm(s)

(Error code: ssl_error_no_cypher_overlap)
share|improve this question

2 Answers 2

up vote 2 down vote accepted

As it turns out the issue was that:

Since version 1.0.5, nginx uses “ssl_protocols SSLv3 TLSv1” and “ssl_ciphers HIGH:!aNULL:!MD5” by default

(http://nginx.org/en/docs/http/configuring_https_servers.html#chains)

I've added the following to my settings and it works.

ssl_protocols        SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers          HIGH:!aNULL:!MD5;
share|improve this answer
3  
So, your clients were actually set (unusually) to use just TLSv1.1 and TLSv1.2? –  cjc Apr 18 '12 at 18:04

So, I'm seeing this:

$ sslscan --no-failed dev.anuary.com
               _
       ___ ___| |___  ___ __ _ _ __
      / __/ __| / __|/ __/ _` | '_ \
      \__ \__ \ \__ \ (_| (_| | | | |
      |___/___/_|___/\___\__,_|_| |_|

              Version 1.8.2
         http://www.titania.co.uk
    Copyright Ian Ventura-Whiting 2009

Testing SSL server dev.anuary.com on port 443

  Supported Server Cipher(s):
    Accepted  TLSv1  256 bits  DHE-RSA-AES256-SHA
    Accepted  TLSv1  256 bits  AES256-SHA
    Accepted  TLSv1  128 bits  DHE-RSA-AES128-SHA
    Accepted  TLSv1  128 bits  AES128-SHA
    Accepted  TLSv1  168 bits  EDH-RSA-DES-CBC3-SHA
    Accepted  TLSv1  168 bits  DES-CBC3-SHA
    Accepted  TLSv1  128 bits  RC4-SHA

  Prefered Server Cipher(s):
    TLSv1  128 bits  RC4-SHA

Is it possible the client can't do TLSv1?

share|improve this answer
    
This have been reported by people using Firefox 2.*, Firefox 3.6.* and IE 8. –  Guy Apr 18 '12 at 15:24
    
On IE8, I seem to be able to get to the 404, so the connection is successful in terms of SSL negotiation. If I go and turn off TLSv1 in Internet Options, I get a connection error. Is it possible the users have disabled TLSv1 for some reason? Are they behind some SSL appliance that might have disabled TLSv1? –  cjc Apr 18 '12 at 15:32
    
FWIW, mail.google.com still supports SSLv3. Is there any reason you've limited yourself to TLSv1? –  cjc Apr 18 '12 at 15:33
    
Is this something I set, or is it something that comes with my SSL cert and I cannot change? If it is the former, what settings should I change. –  Guy Apr 18 '12 at 17:38
    
On a side note, when I've checked my site using networking4all.com/en/support/tools/site+check/report/… it says No connection upgrade to 128-bit for old browsers. I wonder how to enable that. –  Guy Apr 18 '12 at 17:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.