# SSL certificate error - no cipher suites in common **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [August 13, 2015, 8:45am UTC](https://discuss.elastic.co/t/ssl-certificate-error-no-cipher-suites-in-common/27311 "2015-08-13T08:45:54Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Babadofar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/babadofar/32/44803_2.png) [@Babadofar](https://discuss.elastic.co/u/Babadofar)\ **Post date:** [August 13, 2015, 8:45am UTC](https://discuss.elastic.co/t/ssl-certificate-error-no-cipher-suites-in-common/27311/1 "2015-08-13T08:45:54Z")
Using an SSL certificate issued by Comodo, I get this error ``` [2015-08-13 09:10:41,902][WARN][shield.transport.netty] [-es-1] exception caught on transport layer [[id: 0xcc16773e, /10.87.80.15:58445 => /10.87.80.15:9300]], closing connection javax.net.ssl.SSLHandshakeException: no cipher suites in common at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1348) at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:519) at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:796) at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:764) at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624) ``` I used the procedure as described here. [https://www.elastic.co/guide/en/shield/current/ssl-tls.html#\_install\_the\_newly\_signed\_certificate](https://www.elastic.co/guide/en/shield/current/ssl-tls.html#_install_the_newly_signed_certificate) ``` keytool -importcert -keystore test2.jks -file domain.com_2015.crt ``` Any idea on how to fix the cipher suites? Best regards, Christoffer ---
**Author:** ![msimos](https://avatars.discourse-cdn.com/v4/letter/m/bb73d2/32.png) [@msimos](https://discuss.elastic.co/u/msimos)\ **Post date:** [August 13, 2015, 9:43pm UTC](https://discuss.elastic.co/t/ssl-certificate-error-no-cipher-suites-in-common/27311/2 "2015-08-13T21:43:15Z")
Is this a free cert or one you paid for? Also how did you generate your key & CSR? Did you use the command here: [https://www.elastic.co/guide/en/shield/current/ssl-tls.html#generate-csr](https://www.elastic.co/guide/en/shield/current/ssl-tls.html#generate-csr) ```auto keytool -certreq \ -alias node01 \ -keystore node01.jks \ -file node01.csr \ -keyalg rsa \ -ext san=dns:node01.example.com,ip:192.168.1.1 ``` ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [August 14, 2015, 12:41pm UTC](https://discuss.elastic.co/t/ssl-certificate-error-no-cipher-suites-in-common/27311/4 "2015-08-14T12:41:46Z")
That exception can be very misleading as it more commonly has to do with an issue in the keystore setup rather than there being no cipher suites in common on both sides. Can you provide the output of `keytool -list -v -keystore test2.jks` and can you also see what gets output if you use `openssl s_client -connect 10.87.80.15:9300`? ---
**Author:** ![Babadofar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/babadofar/32/44803_2.png) [@Babadofar](https://discuss.elastic.co/u/Babadofar)\ **Post date:** [August 14, 2015, 1:21pm UTC](https://discuss.elastic.co/t/ssl-certificate-error-no-cipher-suites-in-common/27311/5 "2015-08-14T13:21:01Z")
Thanks Mike and Jay. I suspect there is something wrong with the certificate. Will look closer on it next week. ---
**Author:** ![Babadofar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/babadofar/32/44803_2.png) [@Babadofar](https://discuss.elastic.co/u/Babadofar)\ **Post date:** [August 17, 2015, 12:15pm UTC](https://discuss.elastic.co/t/ssl-certificate-error-no-cipher-suites-in-common/27311/6 "2015-08-17T12:15:14Z")
It got it working after receiving a new certficate, with the full chain. ---
**Author:** ![jliaocxr](https://avatars.discourse-cdn.com/v4/letter/j/ea666f/32.png) [@jliaocxr](https://discuss.elastic.co/u/jliaocxr)\ **Post date:** [November 1, 2015, 10:40pm UTC](https://discuss.elastic.co/t/ssl-certificate-error-no-cipher-suites-in-common/27311/7 "2015-11-01T22:40:42Z")
Hi, I am receiving quite similar exception like Christopher. [2015-11-01 16:01:15,324][WARN][shield.transport.netty] [node01] Caught exception while handling client http traffic, closing connection [id: 0x5479d43a, /127.0.0.1:33934 =\> /127.0.0.1:9200] javax.net.ssl.SSLHandshakeException: no cipher suites in common at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1431) . . . Caused by: javax.net.ssl.SSLHandshakeException: no cipher suites in common at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1666) at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:304) at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:292) . . . And downsomewhere in the trace i have the following exception: Caused by: javax.net.ssl.SSLHandshakeException: Client requested protocol SSLv3 not enabled or not supported when I run the following curl command **curl -u es\_admin -XGET '[https://127.0.0.1:9200](https://127.0.0.1:9200)'** Output is: Enter host password for user 'es\_admin': (I Provide the correct password) curl: (35) error:14077410:SSL routines:SSL23\_GET\_SERVER\_HELLO:sslv3 alert handshake fail **Output for: openssl s\_client -connect 127.0.0.1:9300** CONNECTED(00000003) 139800579409568:error:14077410:SSL routines:SSL23\_GET\_SERVER\_HELLO:sslv3 alert handshake failure:s23\_clnt.c:762: no peer certificate available No client certificate CA names sent SSL handshake has read 7 bytes and written 317 bytes New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE It seems like there's something wrong with the certificate only. I created my own CA anf followed steps on: [https://www.elastic.co/guide/en/shield/current/certificate-authority.html](https://www.elastic.co/guide/en/shield/current/certificate-authority.html) [https://www.elastic.co/guide/en/shield/current/ssl-tls.html](https://www.elastic.co/guide/en/shield/current/ssl-tls.html) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 1, 2015, 10:43pm UTC](https://discuss.elastic.co/t/ssl-certificate-error-no-cipher-suites-in-common/27311/8 "2015-11-01T22:43:20Z")
Please start your own thread. ---
**Author:** ![jliaocxr](https://avatars.discourse-cdn.com/v4/letter/j/ea666f/32.png) [@jliaocxr](https://discuss.elastic.co/u/jliaocxr)\ **Post date:** [November 1, 2015, 10:49pm UTC](https://discuss.elastic.co/t/ssl-certificate-error-no-cipher-suites-in-common/27311/9 "2015-11-01T22:49:17Z")
Done. Thanks for correcting me. I thought it would be ok if I would share my similar problem here. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:48pm UTC](https://discuss.elastic.co/t/ssl-certificate-error-no-cipher-suites-in-common/27311/10 "2017-07-06T13:48:07Z")