Ошибка отсутствуют общие алгоритмы шифрования

При попытке соединения с каким-либо сайтом пользователь может получить сообщение об ошибке ssl_error_no_cypher_overlap. В этом материале я расскажу, что это за код ошибки, поясню причины её возникновения, а также поведаю, как исправить ошибку ssl_error_no_cypher_overlap на вашем ПК.

Как видно из формулировки ошибки ssl_error_no_cypher_overlap, данная проблема возникает в случае отсутствия поддержки определёнными сайтами некоторых протоколов шифрования (no_cypher_overlap). Обычно речь идёт об использовании сайтом протокола SSL версии 3.0 (создан в далёком 1996 году), работа с которым в наше время может самым грустным образом сказаться на общей безопасности соединения и сохранности передаваемых данных.

Несмотря на то, что протокол SSL пережил своё дальнейшее развитие, объективированное в протоколах TLS, некоторые сайты ещё продолжают требовать от пользователей применение устаревшего SSL. Потому активация и применение SSL на вашем браузере будет совершаться вами на ваш страх и риск.

Причины возникновения ошибки в браузере

Как уже упоминалось, основная причина возникновения ошибки SSL Error – это использование сайтом устаревшего протокола, также причиной возникновения проблемы может являться деятельность вирусных и антивирусных программ, блокирующих или модифицирующих сетевое интернет-соединение.

При этом чаще всего рассматриваемая ошибка фиксируется на браузере Mozilla Firefox (особенно, после обновления №34), на других браузерах она встречается крайне редко.

Как исправить ошибку ssl_error_no_cypher_overlap

Приведу список методов по устранению рассматриваемой ошибки:

1. Перезагрузите свой компьютер. Данный совет-клише иногда помогает;
2. Проверьте ваш компьютер на наличие вирусных программ с помощью надёжного антивируса;
3. Попробуйте временно отключить ваш антивирус и файервол, а затем попробуйте зайти на проблемный сайт;
4. Используйте другой браузер. Поскольку чаще всего данная ошибка возникает на Firefox, смена браузера может исправить проблему;
5. Измените настройки Firefox. Для этого откройте в вашей Мозилле новое окно, впишите в адресной строке about:config и нажмите ввод. Подтвердите принятие на себя риска, а затем в строке поиска введите security.tls.version. После получения результатов из нескольких значений измените значение параметров security.tls.version.fallback-limit и security.tls.version.min на 0. После данных новаций попробуйте вновь зайти на проблемный сайт, он должен загрузиться.
6. Отключите https. Инструкция .

Заключение

Чаще всего в возникновении проблемы ssl_error_no_cypher_overlap виноват устаревший криптографический протокол SSL, который используют некоторые сайты. Если вы пользуетесь «лисой», тогда смените значение некоторых параметров браузера как указано сверху, в иных же случаях может помочь временное отключение антивируса и файервола, а также смена браузера.

Современные браузеры отличаются действительно эффективными антивирусными возможностями. Даже без разных сторонних программ они смогут защитить компьютер от проникновения в него шпионских троянов. Однако именно из-за подобных чрезмерных мер, пользователи получают блокирования надежных интернет страниц безосновательно. Одной из подобных блокировок становится «ssl_error_no_cypher_overlap». Еще вчерашний хороший сайт (например, zakupki.gov) внезапно перестает загружаться. Подобное очень часто встречается на браузере Firefox и Internet Explorer.

Причины ошибки

Из самой ошибки можно понять, что протокол SSLv3 более не поддерживается, а без данной степени безопасности браузер не может произвести соединение. То есть, никто не может ручаться за вашу безопасность, поэтому наилучшее решение — заблокировать интернет соединение.

Код ошибки «ssl_error_no_cypher_overlap» в Mozilla Firefox

Причиной же становиться обновление браузера Firefox до последней версии, по непонятным причинам с 34 версии он начинает очень сильно возмущаться при подключении подозрительных SSL. Браузер находит на посещаемом ресурсе некоторые плагины, скрипты и взломанные протоколы безопасности, которые могут собирать информацию о пользователе, и блокирует к веб-сайту доступ. Другой возможной проблемой становится антивирус или действующий в вашей системе троян (угонщик браузера).

Исправляем ошибку подключения

Сразу замечу, что момент с зараженным ПК уберем, пользователь должен постоянно сканировать систему антивирусами и сканерами на наличие зловредов. Хорошо борется с угонщиками — AdwCleaner, например.

Итак, для начала уккажем простые советы для быстрого решения:

• Используя Firefox, почистите все куки и кэш, а также историю.
• Отключите на время защиту ОС и с ней экран антивируса.
• Воспользуйтесь другим браузером, предварительно деинсталлировав Firefox с перезагрузкой ПК.
• Замените файл hosts рекомендуемым от Майкрософт. Его найдете на официальной странице корпорации.

Изменяем настройки Firefox

Более сложным вариантом остается изменение параметров браузера. Следует проследовать в его корневое меню и сменить несколько требуемых пунктов:

• Откроем новую страницу в Firefox. Прописываем в графе поиска: about:config

• Из нескольких пунктов выбираем только два: security.tls.version.fallback-limit
  и security.tls.version.min
  

Имейте ввиду, что проставив нулевые значения, вы сделали браузер уязвимым, поэтому постарайтесь сразу же вернуть все значения обратно. А администратору сайта желательно указать на проблему.

Это в большинстве случаев это помогает исправить код ошибки ssl_error_no_cypher_overlap в браузере. Но следует учитывать очень важный момент, теперь вы менее защищены от вредоносных программ. Поэтому лучше много раз подумайте, стоит ли этот сайт увеличение рисков заражения компьютера вирусными программами. Может легче сменить браузер или найти другой источник в интернете.

I»m developing a web app. Currently, I»m using a self-signed certificate (getting it properly signed comes later).

When I have the web server set so that it only accepts TLS1.1 and TLS1.2, I»m getting a SSL_ERROR_NO_CYPHER_OVERLAP error. And, of course, trying the «use outdated security» link doesn»t work, since the web server won»t allow those connections.

If I temporarily allow insecure connections on the web server, Firefox will then allow me to accept the cert. After the cert is accepted, Firefox can then connect over only TLS1.1 and TLS1.2. So, most of the time, Firefox can find a common cypher for TLS1.1/1.2 connections.

(The web server is on an Ubuntu kernel, with OpenSSL1.0.1f.)

I»m developing a web app. Currently, I»m using a self-signed certificate (getting it properly signed comes later).
When I have the web server set so that it only accepts TLS1.1 and TLS1.2, I»m getting a SSL_ERROR_NO_CYPHER_OVERLAP error. And, of course, trying the «use outdated security» link doesn»t work, since the web server won»t allow those connections.
If I temporarily allow insecure connections on the web server, Firefox will then allow me to accept the cert. After the cert is accepted, Firefox can then connect over only TLS1.1 and TLS1.2. So, most of the time, Firefox can find a common cypher for TLS1.1/1.2 connections.
(The web server is on an Ubuntu kernel, with OpenSSL1.0.1f.)

Chosen solution

I finally figured out what is going on.

The fix is really in configuring OpenSSL; however, since Firefox is the browser that most readily displays the problem, I»m going to post the answer here.

Anyway, at issue is the separation in OpenSSL of the protocols supported vs. the cipher list.

In an app using OpenSSL, if you»re using anything older than OpenSSL 1.1.0, you»ll need to disable any protocol older than TLSv1. Do this with:

SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);

(Note that recent versions of OpenSSL before version 1.1.0 have SSLv2 turned off by default, but it doesn»t hurt to explicitly disable it with this call. Also note that if you disable TLSv1 , you»ll break compatibility with some apps that make HTTPS calls; for example Firefox appears to use TLSv1 to do the certificate exchange, before going to stronger protocols for the session).

The key to understanding the SSL_NO_CYPHER_OVERLAP error is that TLSv1 only uses SSLv3 ciphers.

So, I was running into this issue because when I disabled SSLv3, I was also disabling the SSLv3 ciphers. To set the OpenSSL ciphers, use something like:

SSL_CTL_set_cipher_list(ctx, «TLSv1.2:TLSv1:SSLv3:!SSLv2:HIGH:!MEDIUM:!LOW»);

If you use instead (as I was originally using):

SSL_CTL_set_cipher_list(ctx, «TLSv1.2:TLSv1:!SSLv3:!SSLv2:HIGH:!MEDIUM:!LOW»);

You»ll effectively disable TLSv1, since there are no TLSv1-specific ciphers (at least in OpenSSL), and with the SSLv3 ciphers disabled, it isn»t possible to establish a TLSv1 connection.

With SSLv3 disabled, but the TLSv1/SSLv3 ciphers enabled, Firefox is able to get the certificates. After this, I see that Firefox then establishes a TLSv1.2 connection.

Most of the above solution is not needed for OpenSSL 1.1.0, since that has no support for SSLv3 at all.

Read this answer in context
4

Question owner

Thanks for your reply.

Unfortunately, I»m developing behind a firewall, so said site isn»t able to scan it.

Is there a way to find out what ciphers Firefox attempted?

(It still seems strange that if I have Firefox accept the certificate, by temporarily reducing security, that Firefox is then able to agree on a high security cipher.)

Thanks for your reply.
Unfortunately, I»m developing behind a firewall, so said site isn»t able to scan it.
Is there a way to find out what ciphers Firefox attempted?
(It still seems strange that if I have Firefox accept the certificate, by temporarily reducing security, that Firefox is then able to agree on a high security cipher.)

What connection settings does Firefox use if you allow lower security?

You can check that in the Security tab in the Network Monitor.

What connection settings does Firefox use if you allow lower security?
You can check that in the Security tab in the Network Monitor.
*https://developer.mozilla.org/Tools/Network_Monitor

Question owner

Don»t know if I»m quite clicking on the correct place.

With Network Monitor open, if I click on the GET request, the security tab is only saying that the security certificate is invalid (which I expect, since it is invalid).

In experimenting with different security settings on the server, it appears that when I get «invalid certificate», it is using SSLv3, while if I set the server for TLS only, I get «no cypher overlap» (although I»m not seeing a SSLv3 warning in the security tab).

If I go to about:config, and search on security*ssl, I see a large number of enabled ciphers in the list. If I search on security*tls, I don»t see any ciphers listed.

I»ve attached screen shots. The one with «no cypher overlap» is what I get when I disable SSLv3 on my web server, and the one with «unknown issuer» is what I get when I enable SSLv3 on my web server.

(Both Chrome and IE just give me the «invalid certificate» error, but will otherwise connect.)

Don»t know if I»m quite clicking on the correct place.
With Network Monitor open, if I click on the GET request, the security tab is only saying that the security certificate is invalid (which I expect, since it is invalid).
In experimenting with different security settings on the server, it appears that when I get «invalid certificate», it is using SSLv3, while if I set the server for TLS only, I get «no cypher overlap» (although I»m not seeing a SSLv3 warning in the security tab).
If I go to about:config, and search on security*ssl, I see a large number of enabled ciphers in the list. If I search on security*tls, I don»t see any ciphers listed.
I»ve attached screen shots. The one with «no cypher overlap» is what I get when I disable SSLv3 on my web server, and the one with «unknown issuer» is what I get when I enable SSLv3 on my web server.
(Both Chrome and IE just give me the «invalid certificate» error, but will otherwise connect.)

Причины возникновения ошибки в браузере

Как уже упоминалось, основная причина возникновения ошибки SSL Error – это использование сайтом устаревшего протокола, также причиной возникновения проблемы может являться деятельность вирусных и антивирусных программ, блокирующих или модифицирующих сетевое интернет-соединение.

При этом чаще всего рассматриваемая ошибка фиксируется на браузере Mozilla Firefox (особенно, после обновления №34), на других браузерах она встречается крайне редко.

Как исправить ошибку ssl_error_no_cypher_overlap

Приведу список методов по устранению рассматриваемой ошибки:

1. Перезагрузите свой компьютер. Данный совет-клише иногда помогает;
2. Проверьте ваш компьютер на наличие вирусных программ с помощью надёжного антивируса;
3. Попробуйте временно отключить ваш антивирус и файервол, а затем попробуйте зайти на проблемный сайт;
4. Используйте другой браузер. Поскольку чаще всего данная ошибка возникает на Firefox, смена браузера может исправить проблему;
5. Измените настройки Firefox. Для этого откройте в вашей Мозилле новое окно, впишите в адресной строке about:config и нажмите ввод. Подтвердите принятие на себя риска, а затем в строке поиска введите security.tls.version. После получения результатов из нескольких значений измените значение параметров security.tls.version.fallback-limit и security.tls.version.min на 0. После данных новаций попробуйте вновь зайти на проблемный сайт, он должен загрузиться.
6. Отключите https. Инструкция .

Заключение

Чаще всего в возникновении проблемы ssl_error_no_cypher_overlap виноват устаревший криптографический протокол SSL, который используют некоторые сайты. Если вы пользуетесь «лисой», тогда смените значение некоторых параметров браузера как указано сверху, в иных же случаях может помочь временное отключение антивируса и файервола, а также смена браузера.

Современные браузеры отличаются действительно эффективными антивирусными возможностями. Даже без разных сторонних программ они смогут защитить компьютер от проникновения в него шпионских троянов. Однако именно из-за подобных чрезмерных мер, пользователи получают блокирования надежных интернет страниц безосновательно. Одной из подобных блокировок становится «ssl_error_no_cypher_overlap». Еще вчерашний хороший сайт (например, zakupki.gov) внезапно перестает загружаться. Подобное очень часто встречается на браузере Firefox и Internet Explorer.

Причины ошибки

Из самой ошибки можно понять, что протокол SSLv3 более не поддерживается, а без данной степени безопасности браузер не может произвести соединение. То есть, никто не может ручаться за вашу безопасность, поэтому наилучшее решение — заблокировать интернет соединение.

Код ошибки «ssl_error_no_cypher_overlap» в Mozilla Firefox

Причиной же становиться обновление браузера Firefox до последней версии, по непонятным причинам с 34 версии он начинает очень сильно возмущаться при подключении подозрительных SSL. Браузер находит на посещаемом ресурсе некоторые плагины, скрипты и взломанные протоколы безопасности, которые могут собирать информацию о пользователе, и блокирует к веб-сайту доступ. Другой возможной проблемой становится антивирус или действующий в вашей системе троян (угонщик браузера).

Исправляем ошибку подключения

Сразу замечу, что момент с зараженным ПК уберем, пользователь должен постоянно сканировать систему антивирусами и сканерами на наличие зловредов. Хорошо борется с угонщиками — AdwCleaner, например.

Итак, для начала уккажем простые советы для быстрого решения:

• Используя Firefox, почистите все куки и кэш, а также историю.
• Отключите на время защиту ОС и с ней экран антивируса.
• Воспользуйтесь другим браузером, предварительно деинсталлировав Firefox с перезагрузкой ПК.
• Замените файл hosts рекомендуемым от Майкрософт. Его найдете на официальной странице корпорации.

Изменяем настройки Firefox

Более сложным вариантом остается изменение параметров браузера. Следует проследовать в его корневое меню и сменить несколько требуемых пунктов:

• Откроем новую страницу в Firefox. Прописываем в графе поиска: about:config

• Из нескольких пунктов выбираем только два: security.tls.version.fallback-limit
  и security.tls.version.min
  

Имейте ввиду, что проставив нулевые значения, вы сделали браузер уязвимым, поэтому постарайтесь сразу же вернуть все значения обратно. А администратору сайта желательно указать на проблему.

Это в большинстве случаев это помогает исправить код ошибки ssl_error_no_cypher_overlap в браузере. Но следует учитывать очень важный момент, теперь вы менее защищены от вредоносных программ. Поэтому лучше много раз подумайте, стоит ли этот сайт увеличение рисков заражения компьютера вирусными программами. Может легче сменить браузер или найти другой источник в интернете.

I»m developing a web app. Currently, I»m using a self-signed certificate (getting it properly signed comes later).

When I have the web server set so that it only accepts TLS1.1 and TLS1.2, I»m getting a SSL_ERROR_NO_CYPHER_OVERLAP error. And, of course, trying the «use outdated security» link doesn»t work, since the web server won»t allow those connections.

If I temporarily allow insecure connections on the web server, Firefox will then allow me to accept the cert. After the cert is accepted, Firefox can then connect over only TLS1.1 and TLS1.2. So, most of the time, Firefox can find a common cypher for TLS1.1/1.2 connections.

(The web server is on an Ubuntu kernel, with OpenSSL1.0.1f.)

I»m developing a web app. Currently, I»m using a self-signed certificate (getting it properly signed comes later).
When I have the web server set so that it only accepts TLS1.1 and TLS1.2, I»m getting a SSL_ERROR_NO_CYPHER_OVERLAP error. And, of course, trying the «use outdated security» link doesn»t work, since the web server won»t allow those connections.
If I temporarily allow insecure connections on the web server, Firefox will then allow me to accept the cert. After the cert is accepted, Firefox can then connect over only TLS1.1 and TLS1.2. So, most of the time, Firefox can find a common cypher for TLS1.1/1.2 connections.
(The web server is on an Ubuntu kernel, with OpenSSL1.0.1f.)

Chosen solution

I finally figured out what is going on.

The fix is really in configuring OpenSSL; however, since Firefox is the browser that most readily displays the problem, I»m going to post the answer here.

Anyway, at issue is the separation in OpenSSL of the protocols supported vs. the cipher list.

In an app using OpenSSL, if you»re using anything older than OpenSSL 1.1.0, you»ll need to disable any protocol older than TLSv1. Do this with:

SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);

(Note that recent versions of OpenSSL before version 1.1.0 have SSLv2 turned off by default, but it doesn»t hurt to explicitly disable it with this call. Also note that if you disable TLSv1 , you»ll break compatibility with some apps that make HTTPS calls; for example Firefox appears to use TLSv1 to do the certificate exchange, before going to stronger protocols for the session).

The key to understanding the SSL_NO_CYPHER_OVERLAP error is that TLSv1 only uses SSLv3 ciphers.

So, I was running into this issue because when I disabled SSLv3, I was also disabling the SSLv3 ciphers. To set the OpenSSL ciphers, use something like:

SSL_CTL_set_cipher_list(ctx, «TLSv1.2:TLSv1:SSLv3:!SSLv2:HIGH:!MEDIUM:!LOW»);

If you use instead (as I was originally using):

SSL_CTL_set_cipher_list(ctx, «TLSv1.2:TLSv1:!SSLv3:!SSLv2:HIGH:!MEDIUM:!LOW»);

You»ll effectively disable TLSv1, since there are no TLSv1-specific ciphers (at least in OpenSSL), and with the SSLv3 ciphers disabled, it isn»t possible to establish a TLSv1 connection.

With SSLv3 disabled, but the TLSv1/SSLv3 ciphers enabled, Firefox is able to get the certificates. After this, I see that Firefox then establishes a TLSv1.2 connection.

Most of the above solution is not needed for OpenSSL 1.1.0, since that has no support for SSLv3 at all.

Read this answer in context
4

Question owner

Thanks for your reply.

Unfortunately, I»m developing behind a firewall, so said site isn»t able to scan it.

Is there a way to find out what ciphers Firefox attempted?

(It still seems strange that if I have Firefox accept the certificate, by temporarily reducing security, that Firefox is then able to agree on a high security cipher.)

Thanks for your reply.
Unfortunately, I»m developing behind a firewall, so said site isn»t able to scan it.
Is there a way to find out what ciphers Firefox attempted?
(It still seems strange that if I have Firefox accept the certificate, by temporarily reducing security, that Firefox is then able to agree on a high security cipher.)

What connection settings does Firefox use if you allow lower security?

You can check that in the Security tab in the Network Monitor.

What connection settings does Firefox use if you allow lower security?
You can check that in the Security tab in the Network Monitor.
*https://developer.mozilla.org/Tools/Network_Monitor

Question owner

Don»t know if I»m quite clicking on the correct place.

With Network Monitor open, if I click on the GET request, the security tab is only saying that the security certificate is invalid (which I expect, since it is invalid).

In experimenting with different security settings on the server, it appears that when I get «invalid certificate», it is using SSLv3, while if I set the server for TLS only, I get «no cypher overlap» (although I»m not seeing a SSLv3 warning in the security tab).

If I go to about:config, and search on security*ssl, I see a large number of enabled ciphers in the list. If I search on security*tls, I don»t see any ciphers listed.

I»ve attached screen shots. The one with «no cypher overlap» is what I get when I disable SSLv3 on my web server, and the one with «unknown issuer» is what I get when I enable SSLv3 on my web server.

(Both Chrome and IE just give me the «invalid certificate» error, but will otherwise connect.)

Don»t know if I»m quite clicking on the correct place.
With Network Monitor open, if I click on the GET request, the security tab is only saying that the security certificate is invalid (which I expect, since it is invalid).
In experimenting with different security settings on the server, it appears that when I get «invalid certificate», it is using SSLv3, while if I set the server for TLS only, I get «no cypher overlap» (although I»m not seeing a SSLv3 warning in the security tab).
If I go to about:config, and search on security*ssl, I see a large number of enabled ciphers in the list. If I search on security*tls, I don»t see any ciphers listed.
I»ve attached screen shots. The one with «no cypher overlap» is what I get when I disable SSLv3 on my web server, and the one with «unknown issuer» is what I get when I enable SSLv3 on my web server.
(Both Chrome and IE just give me the «invalid certificate» error, but will otherwise connect.)

Modified May 18, 2016 at 9:55:13 AM PDT by gshonle

Question owner

I did a tcpdump trace; 10.1.233.67 is the system running Firefox; 10.1.85.41 is the Linux server. See attached image.

Here are the TLSv1.2 ciphers supported by the Linux OpenSSL:

ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-SHA384
ECDHE-ECDSA-AES256-SHA384
DHE-DSS-AES256-GCM-SHA384
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES256-SHA256
DHE-DSS-AES256-SHA256
ECDH-RSA-AES256-GCM-SHA384
ECDH-ECDSA-AES256-GCM-SHA384
ECDH-RSA-AES256-SHA384
ECDH-ECDSA-AES256-SHA384
AES256-GCM-SHA384
AES256-SHA256
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-SHA256
ECDHE-ECDSA-AES128-SHA256
DHE-DSS-AES128-GCM-SHA256
DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES128-SHA256
DHE-DSS-AES128-SHA256
ECDH-RSA-AES128-GCM-SHA256
ECDH-ECDSA-AES128-GCM-SHA256
ECDH-RSA-AES128-SHA256
ECDH-ECDSA-AES128-SHA256
AES128-GCM-SHA256
AES128-SHA256

So, it looks like they almost overlap…

I did a tcpdump trace; 10.1.233.67 is the system running Firefox; 10.1.85.41 is the Linux server. See attached image.
Here are the TLSv1.2 ciphers supported by the Linux OpenSSL:
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-SHA384
ECDHE-ECDSA-AES256-SHA384
DHE-DSS-AES256-GCM-SHA384
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES256-SHA256
DHE-DSS-AES256-SHA256
ECDH-RSA-AES256-GCM-SHA384
ECDH-ECDSA-AES256-GCM-SHA384
ECDH-RSA-AES256-SHA384
ECDH-ECDSA-AES256-SHA384
AES256-GCM-SHA384
AES256-SHA256
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-SHA256
ECDHE-ECDSA-AES128-SHA256
DHE-DSS-AES128-GCM-SHA256
DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES128-SHA256
DHE-DSS-AES128-SHA256
ECDH-RSA-AES128-GCM-SHA256
ECDH-ECDSA-AES128-GCM-SHA256
ECDH-RSA-AES128-SHA256
ECDH-ECDSA-AES128-SHA256
AES128-GCM-SHA256
AES128-SHA256
So, it looks like they almost overlap…

SSL handshaking is over my head, but two things:

(1) Under no circumstances will recent versions of Firefox use SSLv3 as a protocol
. The lowest supported protocol is TLS 1.0.

(2) In about:config, the preference names for the ciphers
contain ssl3, but this is an historical artifact and has no bearing on the protocol
that is used. These ciphers need to be enabled in order to be available for TLS connections.

There are two ciphers I recommend setting to false, since they are associated with the Logjam issue:

security.ssl3.dhe_rsa_aes_128_sha
security.ssl3.dhe_rsa_aes_256_sha

Some users may prefer to set the two RC4 ciphers to false as well, but this may create problems with older Microsoft IIS servers.

You should be able to connect securely using these ciphers (your list => Firefox preference name):

ECDHE-RSA-AES128-GCM-SHA256 => security.ssl3.ecdhe_rsa_aes_128_gcm_sha256

ECDHE-ECDSA-AES128-GCM-SHA256 =>

SSL handshaking is over my head, but two things:
(1) Under no circumstances will recent versions of Firefox use SSLv3 as a «»protocol»». The lowest supported protocol is TLS 1.0.
(2) In about:config, the preference names for the «»ciphers»» contain ssl3, but this is an historical artifact and has no bearing on the «»protocol»» that is used. These ciphers need to be enabled in order to be available for TLS connections.
There are two ciphers I recommend setting to false, since they are associated with the Logjam issue:
security.ssl3.dhe_rsa_aes_128_sha
security.ssl3.dhe_rsa_aes_256_sha
Some users may prefer to set the two RC4 ciphers to false as well, but this may create problems with older Microsoft IIS servers.
You should be able to connect securely using these ciphers (your list => Firefox preference name):
ECDHE-RSA-AES128-GCM-SHA256 => security.ssl3.ecdhe_rsa_aes_128_gcm_sha256
ECDHE-ECDSA-AES128-GCM-SHA256 => security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256

Question owner

Both security.ssl3.ecdhe_rsa_aes_128_gcm_sha256 and security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256 are enabled in Firefox (I»m using the default settings for everything).

So… Still puzzled about what»s going on…

Both security.ssl3.ecdhe_rsa_aes_128_gcm_sha256 and security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256 are enabled in Firefox (I»m using the default settings for everything).
So… Still puzzled about what»s going on…

See next post

«»See next post»»
Looking at your last screen shot («Client Hello»), I»m a little baffled. Is that the client machine»s cipher list? It doesn»t match Firefox»s list — in particular, to my knowledge, Firefox does not support any CBC ciphers, which comprise nearly all of what»s listed. Do you have a proxy in front of Firefox on the client?

Modified May 18, 2016 at 11:47:47 AM PDT by jscher2000

Oops, I»m wrong based on this site: https://www.ssllabs.com/ssltest/viewMyClient.html — CBC appears in several of the cipher names there even if they do not appear in about:config.

Cipher Suites (in order of preference)
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b) Forward Secrecy 128
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) Forward Secrecy 128
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a) Forward Secrecy 256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009) Forward Secrecy 128
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) Forward Secrecy 128
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) Forward Secrecy 256
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) 128
TLS_RSA_WITH_AES_256_CBC_SHA (0x35) 256
TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) 112

These two do not appear on my normal list, as I have disabled them as mentioned earlier:

TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33) Forward Secrecy 128
TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39) Forward Secrecy 256

With those, there are 11 as you saw in Client Hello.

Oops, I»m wrong based on this site: https://www.ssllabs.com/ssltest/viewMyClient.html — CBC appears in several of the cipher names there even if they do not appear in about:config.
Cipher Suites (in order of preference)
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b) Forward Secrecy 128
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) Forward Secrecy 128
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a) Forward Secrecy 256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009) Forward Secrecy 128
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) Forward Secrecy 128
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) Forward Secrecy 256
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) 128
TLS_RSA_WITH_AES_256_CBC_SHA (0x35) 256
TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) 112
These two do not appear on my normal list, as I have disabled them as mentioned earlier:
TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33) Forward Secrecy 128
TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39) Forward Secrecy 256
With those, there are 11 as you saw in Client Hello.

Question owner

The Hello Client packet is what was sent by the system running Firefox; it was sent when Firefox attempted the connection.

I double-checked, and I don»t have a proxy in front of Firefox.

To quote Alice: Curiouser and curiouser…

The Hello Client packet is what was sent by the system running Firefox; it was sent when Firefox attempted the connection.
I double-checked, and I don»t have a proxy in front of Firefox.
To quote Alice: Curiouser and curiouser…

Question owner

Yes, OpenSSL 1.0.1f is from January of 2014, and I»d prefer if we went to a newer version. Unfortunately, the current plan is to not move to a newer OpenSSL right now (not my choice).

Any ideas on a next step?

Yes, OpenSSL 1.0.1f is from January of 2014, and I»d prefer if we went to a newer version. Unfortunately, the current plan is to not move to a newer OpenSSL right now (not my choice).
Any ideas on a next step?

What happens if you click the «(Not secure) Try loading» link?

If you also need to override the bad certificate, accept a temporary exception.

Then assuming you get a secure connection, check the protocol and cipher listed on the Page Info dialog, security panel, toward the bottom, which you can view using either:

• right-click (on Mac Ctrl+click) a blank area of the page and choose View Page Info > Security
• (menu bar) Tools > Page Info > Security
• click the padlock or «i» icon in the address bar, then the «>» button, then More Information

What shows as in use there?

What happens if you click the «(Not secure) Try loading» link?
If you also need to override the bad certificate, accept a temporary exception.
Then assuming you get a secure connection, check the protocol and cipher listed on the Page Info dialog, security panel, toward the bottom, which you can view using either:
* right-click (on Mac Ctrl+click) a blank area of the page and choose View Page Info > Security
* (menu bar) Tools > Page Info > Security
* click the padlock or «i» icon in the address bar, then the «>» button, then More Information
What shows as in use there?

Question owner

See attached for what happens if I click on the (Not secure) link. Since my server is set to not use SSLv3, Firefox can»t connect.

If I temporarily enable SSLv3 on my server, I can accept the invalid certificate. Then, the connection uses TLS 1.2 (Cipher is TLS_RSA_WITH_AES_128_CBC_SHA, 128 bit keys). (If I permanently accept the certificate, I can always connect immediately, even with SSLv3 disabled on my server.)

See attached for what happens if I click on the (Not secure) link. Since my server is set to not use SSLv3, Firefox can»t connect.
If I temporarily enable SSLv3 on my server, I can accept the invalid certificate. Then, the connection uses TLS 1.2 (Cipher is TLS_RSA_WITH_AES_128_CBC_SHA, 128 bit keys). (If I permanently accept the certificate, I can always connect immediately, even with SSLv3 disabled on my server.)

SSL handshaking is over my head, but two things:

(1) Under no circumstances will recent versions of Firefox use SSLv3 as a protocol
. The lowest supported protocol is TLS 1.0.

(2) In about:config, the preference names for the ciphers
contain ssl3, but this is an historical artifact and has no bearing on the protocol
that is used. These ciphers need to be enabled in order to be available for TLS connections.

There are two ciphers I recommend setting to false, since they are associated with the Logjam issue:

security.ssl3.dhe_rsa_aes_128_sha
security.ssl3.dhe_rsa_aes_256_sha

Some users may prefer to set the two RC4 ciphers to false as well, but this may create problems with older Microsoft IIS servers.

You should be able to connect securely using these ciphers (your list => Firefox preference name):

ECDHE-RSA-AES128-GCM-SHA256 => security.ssl3.ecdhe_rsa_aes_128_gcm_sha256

ECDHE-ECDSA-AES128-GCM-SHA256 =>

SSL handshaking is over my head, but two things:
(1) Under no circumstances will recent versions of Firefox use SSLv3 as a «»protocol»». The lowest supported protocol is TLS 1.0.
(2) In about:config, the preference names for the «»ciphers»» contain ssl3, but this is an historical artifact and has no bearing on the «»protocol»» that is used. These ciphers need to be enabled in order to be available for TLS connections.
There are two ciphers I recommend setting to false, since they are associated with the Logjam issue:
security.ssl3.dhe_rsa_aes_128_sha
security.ssl3.dhe_rsa_aes_256_sha
Some users may prefer to set the two RC4 ciphers to false as well, but this may create problems with older Microsoft IIS servers.
You should be able to connect securely using these ciphers (your list => Firefox preference name):
ECDHE-RSA-AES128-GCM-SHA256 => security.ssl3.ecdhe_rsa_aes_128_gcm_sha256
ECDHE-ECDSA-AES128-GCM-SHA256 => security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256

Question owner

Both security.ssl3.ecdhe_rsa_aes_128_gcm_sha256 and security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256 are enabled in Firefox (I»m using the default settings for everything).

So… Still puzzled about what»s going on…

Both security.ssl3.ecdhe_rsa_aes_128_gcm_sha256 and security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256 are enabled in Firefox (I»m using the default settings for everything).
So… Still puzzled about what»s going on…

See next post

«»See next post»»
Looking at your last screen shot («Client Hello»), I»m a little baffled. Is that the client machine»s cipher list? It doesn»t match Firefox»s list — in particular, to my knowledge, Firefox does not support any CBC ciphers, which comprise nearly all of what»s listed. Do you have a proxy in front of Firefox on the client?

Modified May 18, 2016 at 11:47:47 AM PDT by jscher2000

Oops, I»m wrong based on this site: https://www.ssllabs.com/ssltest/viewMyClient.html — CBC appears in several of the cipher names there even if they do not appear in about:config.

Cipher Suites (in order of preference)
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b) Forward Secrecy 128
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) Forward Secrecy 128
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a) Forward Secrecy 256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009) Forward Secrecy 128
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) Forward Secrecy 128
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) Forward Secrecy 256
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) 128
TLS_RSA_WITH_AES_256_CBC_SHA (0x35) 256
TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) 112

These two do not appear on my normal list, as I have disabled them as mentioned earlier:

TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33) Forward Secrecy 128
TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39) Forward Secrecy 256

With those, there are 11 as you saw in Client Hello.

Oops, I»m wrong based on this site: https://www.ssllabs.com/ssltest/viewMyClient.html — CBC appears in several of the cipher names there even if they do not appear in about:config.
Cipher Suites (in order of preference)
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b) Forward Secrecy 128
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) Forward Secrecy 128
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a) Forward Secrecy 256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009) Forward Secrecy 128
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) Forward Secrecy 128
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) Forward Secrecy 256
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) 128
TLS_RSA_WITH_AES_256_CBC_SHA (0x35) 256
TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) 112
These two do not appear on my normal list, as I have disabled them as mentioned earlier:
TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33) Forward Secrecy 128
TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39) Forward Secrecy 256
With those, there are 11 as you saw in Client Hello.

Question owner

The Hello Client packet is what was sent by the system running Firefox; it was sent when Firefox attempted the connection.

I double-checked, and I don»t have a proxy in front of Firefox.

To quote Alice: Curiouser and curiouser…

The Hello Client packet is what was sent by the system running Firefox; it was sent when Firefox attempted the connection.
I double-checked, and I don»t have a proxy in front of Firefox.
To quote Alice: Curiouser and curiouser…

Question owner

Yes, OpenSSL 1.0.1f is from January of 2014, and I»d prefer if we went to a newer version. Unfortunately, the current plan is to not move to a newer OpenSSL right now (not my choice).

Any ideas on a next step?

Yes, OpenSSL 1.0.1f is from January of 2014, and I»d prefer if we went to a newer version. Unfortunately, the current plan is to not move to a newer OpenSSL right now (not my choice).
Any ideas on a next step?

What happens if you click the «(Not secure) Try loading» link?

If you also need to override the bad certificate, accept a temporary exception.

Then assuming you get a secure connection, check the protocol and cipher listed on the Page Info dialog, security panel, toward the bottom, which you can view using either:

• right-click (on Mac Ctrl+click) a blank area of the page and choose View Page Info > Security
• (menu bar) Tools > Page Info > Security
• click the padlock or «i» icon in the address bar, then the «>» button, then More Information

What shows as in use there?

What happens if you click the «(Not secure) Try loading» link?
If you also need to override the bad certificate, accept a temporary exception.
Then assuming you get a secure connection, check the protocol and cipher listed on the Page Info dialog, security panel, toward the bottom, which you can view using either:
* right-click (on Mac Ctrl+click) a blank area of the page and choose View Page Info > Security
* (menu bar) Tools > Page Info > Security
* click the padlock or «i» icon in the address bar, then the «>» button, then More Information
What shows as in use there?

Question owner

See attached for what happens if I click on the (Not secure) link. Since my server is set to not use SSLv3, Firefox can»t connect.

If I temporarily enable SSLv3 on my server, I can accept the invalid certificate. Then, the connection uses TLS 1.2 (Cipher is TLS_RSA_WITH_AES_128_CBC_SHA, 128 bit keys). (If I permanently accept the certificate, I can always connect immediately, even with SSLv3 disabled on my server.)

See attached for what happens if I click on the (Not secure) link. Since my server is set to not use SSLv3, Firefox can»t connect.
If I temporarily enable SSLv3 on my server, I can accept the invalid certificate. Then, the connection uses TLS 1.2 (Cipher is TLS_RSA_WITH_AES_128_CBC_SHA, 128 bit keys). (If I permanently accept the certificate, I can always connect immediately, even with SSLv3 disabled on my server.)

I don»t think this has anything to do with SSLv3, since Firefox 46 does not support SSLv3 at all under any circumstances. When you enable SSLv3 on the server, I think that must change something else at the same time.

The error you got was SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT which indicated the server tried to downgrade from TLS1.2 to a lower protocol. That doesn»t really make sense from what you»re describing, but might be seen with RC4 ciphers.

Anyway, no point troubleshooting this old version of OpenSSL any further.

I don»t think this has anything to do with SSLv3, since Firefox 46 does not support SSLv3 at all under any circumstances. When you enable SSLv3 on the server, I think that must change something else at the same time.
The error you got was SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT which indicated the server tried to downgrade from TLS1.2 to a lower protocol. That doesn»t really make sense from what you»re describing, but might be seen with RC4 ciphers.
Anyway, no point troubleshooting this old version of OpenSSL any further.

Question owner

The product I»m working on has an embedded Linux system, with a web server as part of the total product. Because it is not running on standard hardware, we»re limited on which Linux distros we can use. The latest OpenSSL deb package for that distro is 1.0.1f. For reasons beyond the scope of this discussion, we are only using updates that have deb packages.

So, unfortunately, it looks like we»ll have to document that only Chrome and IE are supported, and to not use Firefox.

The product I»m working on has an embedded Linux system, with a web server as part of the total product. Because it is not running on standard hardware, we»re limited on which Linux distros we can use. The latest OpenSSL deb package for that distro is 1.0.1f. For reasons beyond the scope of this discussion, we are only using updates that have deb packages.
So, unfortunately, it looks like we»ll have to document that only Chrome and IE are supported, and to not use Firefox.

Modified May 24, 2016 at 1:07:42 PM PDT by gshonle

Helpful Reply

You might bring it to your supplier»s attention, since they ultimately will be blamed for your product»s inability to make a secure connection with Firefox.

I»m not sure if it»s applicable to your product, but for some websites, you can enable fallback by adding a host name to this preference:

(1) In a new tab, type or paste about:config
in the address bar and press Enter/Return. Click the button promising to be careful.

(2) In the search box above the list, type or paste TLS
and pause while the list is filtered

(3) Double-click the security.tls.insecure_fallback_hosts
preference and, either:

(A) If it»s empty, type or paste the host name and click OK

(B) If one or more other host names is already listed, press the End key to go to the end, type a comma, then type or paste the additonal host name and click OK

You might bring it to your supplier»s attention, since they ultimately will be blamed for your product»s inability to make a secure connection with Firefox.
I»m not sure if it»s applicable to your product, but for some websites, you can enable fallback by adding a host name to this preference:
(1) In a new tab, type or paste «»»about:config»»» in the address bar and press Enter/Return. Click the button promising to be careful.
(2) In the search box above the list, type or paste «»»TLS»»» and pause while the list is filtered
(3) Double-click the «»»security.tls.insecure_fallback_hosts»»» preference and, either:
(A) If it»s empty, type or paste the host name and click OK
(B) If one or more other host names is already listed, press the End key to go to the end, type a comma, then type or paste the additonal host name and click OK

Question owner

If I add the host to the insecure_fallback_hosts, I now get: «The server rejected the handshake because the client downgraded to a lower TLS version than the server supports. Error code: SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT»

The server is currently configured for TLSv1.2, TLSv1.1 and TLSv1.

If I add the host to the insecure_fallback_hosts, I now get: «The server rejected the handshake because the client downgraded to a lower TLS version than the server supports. Error code: SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT»
The server is currently configured for TLSv1.2, TLSv1.1 and TLSv1.

Well, TLS 1.0 is the lowest TLS on both sides, so this error makes no sense. I really don»t know what is going on there. It»s not behaving like other servers users have reported (not that I can read everything posted here).

Forum volunteer can replicate fallback error connecting to server that supports TLS1.1 and TLS1.0 but not TLS1.2

Firewall configuration problem causing fallback error message

Server prefers RC4 ciphers (problem in Firefox 36+):

Unclear whether it was solved

BitDefender possible culprit

BitDefender was the culprit

Well, TLS 1.0 is the lowest TLS on both sides, so this error makes no sense. I really don»t know what is going on there. It»s not behaving like other servers users have reported (not that I can read everything posted here)..] — forum volunteer can replicate fallback error connecting to server that supports TLS1.1 and TLS1.0 but not TLS1..0.2] — firewall configuration problem causing fallback error message
Server prefers RC4 ciphers (problem in Firefox 36+):
— unclear whether it was solved
— BitDefender possible culprit
— BitDefender was the culprit

You can try to increase security.tls.version.min temporarily to 2 (or 3) to see what effect this has.

Ошибка SSL_ERROR_NO_CYPHER_OVERLAP может заблокировать доступ к сайту в Firefox, если отключены протоколы шифрования в браузере или на сервере, требуемые для установки безопасного соединения.

Чем вызвана ошибка?

Во многих случаях эта ошибка препятствует входу на отдельные сайты, которые не могут обеспечить требуемый уровень защиты или протоколы, запрашиваемые браузером. Но существуют и другие причины:

1. Отключены протоколы безопасности SSL3 и TLS в настройках.
2. Используется устаревшая версия Firefox.
3. На сервере используется шифрование RC4, поддержка которого полностью отключена в Firefox.

Доступ к странице может быть заблокирован кодом ошибки SSL_ERROR_NO_CYPHER_OVERLAP, когда браузер не обновлялся продолжительное время. В этом случае включите опцию автоматического обновления или загрузите и установите последнюю версию.

Разверните меню и перейдите в пункт «Настройки».

В разделе Основные найдите раздел «Обновления» и отметьте флажком поле, связанное с автоматической установкой.

Также можно удалить текущую установку Firefox. Откройте раздел «Программы и компоненты» командой appwiz.cpl из окна Win + R. Найдите в списке приложение, щелкните по нему правой кнопкой мыши и выберите «Удалить».

После перезагрузки компьютера загрузите последнюю версию с официального сайта и следуйте инструкциям для ее установки.

Снижение уровня безопасности

Если вход на отдельные сайты прерывается сообщением SSL_ERROR_NO_CYPHER_OVERLAP, то, скорее всего, Firefox считает их небезопасными. В этом случае попробуйте отключить защиту для страниц, которым он не доверяет.

Кликните на значок меню и перейдите в Настройки. На вкладке «Приватность и Защита» перейдите в раздел Защита и снимите флажок с опции «Блокировать опасное и обманывающее содержимое».

После перезапустите браузер и попробуйте открыть ресурс, который не удавалось из-за ошибки SSL_ERROR_NO_CYPHER_OVERLAP. После просмотра включите опцию обратно.

Проверка протоколов TLS

Если продолжаете сталкиваться с кодом SSL_ERROR_NO_CYPHER_OVERLAP, проверьте следующие параметры в расширенных настройках.

Откройте новую вкладку и в адресной строке наберите:
about:config

При отображении страницы предупреждения нажмите на кнопку «Принять риск и продолжить». В панели навигации наберите «TLS». Затем найдите параметр security.tls.version.max. Убедитесь, что указано значение 4, в противном случае, отредактируйте его нажатием на значок карандаша.

Затем сделайте поисковый запрос по SSL3 и проверьте, чтобы значения во всех параметрах были установлены на «true».