# SSL - "no cipher suites in common" **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [April 18, 2016, 5:09pm UTC](https://discuss.elastic.co/t/ssl-no-cipher-suites-in-common/47685 "2016-04-18T17:09:17Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![CamHart](https://avatars.discourse-cdn.com/v4/letter/c/e19b73/32.png) [@CamHart](https://discuss.elastic.co/u/CamHart)\ **Post date:** [April 18, 2016, 5:09pm UTC](https://discuss.elastic.co/t/ssl-no-cipher-suites-in-common/47685/1 "2016-04-18T17:09:17Z")
I'm relatively new to setting up SSL. I have my jks keystore file (generated using letsencrypt--see below). `sudo su yum install git git clone https://github.com/letsencrypt/letsencrypt cd letsencrypt ./letsencrypt-auto --agree-dev-preview --server https://acme-v01.api.letsencrypt.org/directory certonly -d my.domain.name -v --debug cd /etc/elasticsearch/shield keytool -importcert -keystore myTest.jks -file /etc/letsencrypt/live/my.domain.name/fullchain.pem -alias myTest` Then I setup SSL in my elasticsearch.yml file like so: `... network.host: my.domain.name shield.ssl.keystore.path: path/to/myTest.jks shield.ssl.keystore.password: superCoolPassword shield.ssl.keystore.key_password: superCoolPassword shield.transport.ssl: true shield.http.ssl: true shield.ssl.ciphers: ["TLS_RSA_WITH_AES_128_CBC_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA"]` _Note: I should mention, in order to get elasticsearch to bind, I've set my hosts file to direct from [my.domain.name](http://my.domain.name) to my ip address._ My log: `[2016-04-18 15:26:44,421][WARN][shield.transport.netty] [hybrid-0] Caught exception while handling client http traffic, closing connection [id: 0xfbe6e53b, /69.199.209.6:4367 => /172.31.39.221:9200] javax.net.ssl.SSLHandshakeException: no cipher suites in common at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1431) at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535) at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:813) at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781) at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624) at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1218) at org.jboss.netty.handler.ssl.SslHandler.decode(SslHandler.java:852) at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:425) at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303) at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) at org.jboss.netty.handler.ipfilter.IpFilteringHandlerImpl.handleUpstream(IpFilteringHandlerImpl.java:154) at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559) at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268) at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255) at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88) at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108) at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337) at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89) at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178) at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108) at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) Caused by: javax.net.ssl.SSLHandshakeException: no cipher suites in common at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1666) at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:304) at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:292) at sun.security.ssl.ServerHandshaker.chooseCipherSuite(ServerHandshaker.java:1035) at sun.security.ssl.ServerHandshaker.clientHello(ServerHandshaker.java:738) at sun.security.ssl.ServerHandshaker.processMessage(ServerHandshaker.java:221) at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979) at sun.security.ssl.Handshaker$1.run(Handshaker.java:919) at sun.security.ssl.Handshaker$1.run(Handshaker.java:916) at java.security.AccessController.doPrivileged(Native Method) at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1369) at org.jboss.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1392) at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1255) ... 21 more` ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [April 18, 2016, 7:10pm UTC](https://discuss.elastic.co/t/ssl-no-cipher-suites-in-common/47685/2 "2016-04-18T19:10:15Z")
I am not familiar with lets encrypt but my first guess would be that you are missing a key in your keystore since it looks like you only imported a certificate. If you do a `keytool -list -keystore myTest.jks`, do you have a privateKeyEntry? ---
**Author:** ![CamHart](https://avatars.discourse-cdn.com/v4/letter/c/e19b73/32.png) [@CamHart](https://discuss.elastic.co/u/CamHart)\ **Post date:** [April 18, 2016, 8:50pm UTC](https://discuss.elastic.co/t/ssl-no-cipher-suites-in-common/47685/3 "2016-04-18T20:50:00Z")
You are exactly right--my private key was missing. And here are the steps I found to fix it. If you have better ones please feel free to provide. > **[How to use the certificate for Tomcat](https://community.letsencrypt.org/t/how-to-use-the-certificate-for-tomcat/3677#post_3)** > > Hey there. I am a beta participant and have used the client to obtain a certificate for the domain dynamically associated with my NAS. Since I can’t run the client directly on my NAS I used manual mode to get the cert and imported it on my Synology... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:45pm UTC](https://discuss.elastic.co/t/ssl-no-cipher-suites-in-common/47685/4 "2017-07-06T13:45:22Z")