Err_ssl_version_or_cipher_mismatch

Troubleshooting
,
1

My issue: ERR_SSL_VERSION_OR_CIPHER_MISMATCH

How I encountered the problem: Visiting my site

Solutions I’ve tried: Rewriting config file, adjusting cloudflare settings

My config:

server {
    listen 80;
    server_name dev.biomebattle.net;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name dev.biomebattle.net;
    
    # SSL configuration
    ssl_certificate /etc/letsencrypt/live/dev.biomebattle.net/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/dev.biomebattle.net/privkey.pem;
    
    # Modern SSL setup
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers on;
    
    # SSL optimization
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    
    # HSTS (optional, but recommended)
    add_header Strict-Transport-Security "max-age=63072000" always;
    
    location / {
        proxy_pass http://127.0.0.1:3934;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }
    
    error_log /var/log/nginx/development_error.log warn;
    access_log /var/log/nginx/development_access.log combined;
}
1 Like
2

nginx usually expects the certificate to be a .crt file, and the key .key file. Can you verify that cert and key files are correctly formatted and match? You should be able to run the following openssl commands and get the same output from each:

openssl rsa -in KEYFILE -pubout
openssl x509 -in CERTFILE -pubkey -noout
3

Closing this in favor of Resolving ERR_SSL_VERSION_OR_CIPHER_MISMATCH - #7 by alessandro since it seems to be the same issue :slight_smile: