Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My clients are reporting this error. I cannot reproduce it. What's more, I cannot detect any flaws: all report to have a valid cert. I've Google(ed) for ssl_error_no_cypher_overlap, but none of the threads provided any useful guidance.

Cannot communicate securely with peer: no common encryption algorithm(s)

(Error code: ssl_error_no_cypher_overlap)
share|improve this question
up vote 2 down vote accepted

As it turns out the issue was that:

Since version 1.0.5, nginx uses “ssl_protocols SSLv3 TLSv1” and “ssl_ciphers HIGH:!aNULL:!MD5” by default


I've added the following to my settings and it works.

ssl_protocols        SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers          HIGH:!aNULL:!MD5;
share|improve this answer
So, your clients were actually set (unusually) to use just TLSv1.1 and TLSv1.2? – cjc Apr 18 '12 at 18:04

So, I'm seeing this:

$ sslscan --no-failed
       ___ ___| |___  ___ __ _ _ __
      / __/ __| / __|/ __/ _` | '_ \
      \__ \__ \ \__ \ (_| (_| | | | |
      |___/___/_|___/\___\__,_|_| |_|

              Version 1.8.2
    Copyright Ian Ventura-Whiting 2009

Testing SSL server on port 443

  Supported Server Cipher(s):
    Accepted  TLSv1  256 bits  DHE-RSA-AES256-SHA
    Accepted  TLSv1  256 bits  AES256-SHA
    Accepted  TLSv1  128 bits  DHE-RSA-AES128-SHA
    Accepted  TLSv1  128 bits  AES128-SHA
    Accepted  TLSv1  168 bits  EDH-RSA-DES-CBC3-SHA
    Accepted  TLSv1  168 bits  DES-CBC3-SHA
    Accepted  TLSv1  128 bits  RC4-SHA

  Prefered Server Cipher(s):
    TLSv1  128 bits  RC4-SHA

Is it possible the client can't do TLSv1?

share|improve this answer
This have been reported by people using Firefox 2.*, Firefox 3.6.* and IE 8. – Gajus Apr 18 '12 at 15:24
On IE8, I seem to be able to get to the 404, so the connection is successful in terms of SSL negotiation. If I go and turn off TLSv1 in Internet Options, I get a connection error. Is it possible the users have disabled TLSv1 for some reason? Are they behind some SSL appliance that might have disabled TLSv1? – cjc Apr 18 '12 at 15:32
FWIW, still supports SSLv3. Is there any reason you've limited yourself to TLSv1? – cjc Apr 18 '12 at 15:33
Is this something I set, or is it something that comes with my SSL cert and I cannot change? If it is the former, what settings should I change. – Gajus Apr 18 '12 at 17:38
On a side note, when I've checked my site using… it says No connection upgrade to 128-bit for old browsers. I wonder how to enable that. – Gajus Apr 18 '12 at 17:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.