2

Some users have complained that they cannot access our site due to a "secure connection failure" i.e. SSL. The actual error code provided is SSL_ERROR_NO_CYPHER_OVERLAP.

Server is nginx with ubuntu 18.04. SSL has been installed via the laravel forge LetsEncrypt button.

I have tested 4 of our sites using https://www.ssllabs.com and all seem to have the same errors show up.

Errors are only related to certain browsers/OS (generally older versions) i.e.

Chrome 49 / XP SP3  Server sent fatal alert: handshake_failure

I also noticed that only TLS 1.2 protocol is supported with my site, so I am guessing that these older browsers are using an older protocol.

| Protocols                                    |     |
|----------------------------------------------|-----|
| TLS 1.3                                      | No  |
| TLS 1.2                                      | Yes |
| TLS 1.1                                      | No  |
| TLS 1.0                                      | No  |
| SSL 3                                        | No  |
| SSL 2                                        | No  |
| For TLS 1.3 tests, we only support RFC 8446. |     |

Has anyone come across this issue before or have any advice on how to diagnose it further.

Improve this question
2
  • I'm troubleshooting the same core issue that you were earlier this year and have amended my nginx config as outlined in your follow-up answer, but I'm still not getting TLS 1.1 support when SSLLabs re-scans the site. Were there any other steps that you took in order for TLS 1.1 support to start working? Did you have to re-issue a new SSL cert, etc.? In case it matters, I have a Forge-generated Let's Encrypt cert installed on this particular app.
    – rfoote
    May 2, 2019 at 22:56
  • I believe that was all I did. Have you rebooted the server after making the change? I am also using the Forge SSL cert so I do not think that has any effect on the issue.
    – Adam Lambert
    May 3, 2019 at 23:13

1 Answer 1

Reset to default
0

One potential fix around this is to edit the SSL cert configuration within:

sudo nano /etc/nginx/sites-enabled/yoursite.com

I amended the TLS version and cipher certificates to the intermediate settings as recommended by mozilla. It appears as the default Forge setup in now for Modern browsers only, which means many are invalid.

https://mozilla.github.io/server-side-tls/ssl-config-generator/

Re-running the https://www.ssllabs.com/ test shows no errors with browser compatibility but has reduced the cipher strength level a little. So I guess more compatibility with a bit less security.

If anyone has any comments on a better way to do this, please advise.

Improve this answer
2
  • How did it go? Did you ever come to a conclusion?
    – jannej
    Feb 21, 2019 at 14:02
  • 1
    The above has been working fine for me so far!
    – Adam Lambert
    May 3, 2019 at 23:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .