mediumIntermediateSymptom-first#tls#cipher#version#compatibility#openssl

TLS cipher/version mismatch -- legacy client cannot negotiate with modern server

Old Java/Python client gets 'no cipher suites in common' error

Likely source:securityconfiguration

Focused incident mode — strips away everything but this runbook.

Symptoms

  • Old Java/Python client gets 'no cipher suites in common' error
  • openssl s_client shows no overlapping ciphers between client and server
  • curl works with modern OpenSSL but fails with older library versions

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Server cipher list

    nmap --script ssl-enum-ciphers -p <PORT> <HOST>

  • Client supported ciphers

    openssl ciphers -v 'ALL' | head -30

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • nmap shows only AESGCM and CHACHA20 ciphers on the server
  • Client's OpenSSL build only offers AES128-SHA, AES256-SHA (CBC)

Confirm before fixing

openssl s_client -connect <HOST>:<PORT> -cipher 'AES128-SHA' 2>&1 | grep 'Cipher'
READ

Test a CBC cipher to see if the server accepts it

Fix

echo 'Add AES-SHA ciphers to the server cipher list or upgrade the client to a modern OpenSSL.'
READ

Document the cipher compatibility fix

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
nmap --script ssl-enum-ciphers -p <PORT> <HOST>
READ

Enumerate the server's cipher policy

2
openssl ciphers -v 'ALL' 2>/dev/null | head -30
READ

Check client cipher support

3
openssl s_client -connect <HOST>:<PORT> -cipher '<cipher>' 2>&1 | grep 'Cipher'
READ

Test specific cipher negotiation

Prevention

  • Maintain a cipher compatibility matrix for all client types in your environment.
  • Test TLS negotiation from the oldest supported client before updating server cipher policy.
  • Use Mozilla SSL Configuration Generator as a reference for cipher lists.
  • Prefer server cipher policy that supports both AEAD and legacy CBC for transition periods.

Related runbooks

Same stack, same failure family — worth a skim.

TLS handshake fails -- unsupported protocol version (SSLv3, TLS 1.0/1.1 disabled)high

curl: (35) error:14094410:ssl routines:ssl3_read_bytes:sslv3 alert handshake failure

NetworkingIntermediate3 causes
Open runbook
TLS hostname mismatch — certificate doesn't cover the namehigh

'SSL: certificate subject does not match hostname' in clients

TLS & PKIFoundation2 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.