7

I'm having a problem connecting to a website that is hosted with CloudFlare using cURL. When I try to connect to the website with HTTPS (using curl -v https://www.xxxxxx.com), it says:

* About to connect() to www.xxxxxx.com port 443 (#0)
*   Trying 2400:cb00:2048:1::681c:116e...
* Connected to www.xxxxxx.com (2400:cb00:2048:1::681c:116e) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP)
* Cannot communicate securely with peer: no common encryption algorithm(s).
* Error in TLS handshake, trying SSLv3...
> GET / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: www.xxxxxx.com
> Accept: */*
>
* Connection died, retrying a fresh connect
* Closing connection 0
* Issue another request to this URL: 'https://www.xxxxxx.com'
* About to connect() to www.xxxxxx.com port 443 (#1)
*   Trying 2400:cb00:2048:1::681c:116e...
* Connected to www.xxxxxx.com (2400:cb00:2048:1::681c:116e) port 443 (#1)
* TLS disabled due to previous handshake failure
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP)
* Cannot communicate securely with peer: no common encryption algorithm(s).
* Closing connection 1
curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s).

I contacted CloudFlare about this issue and they say its because cURL is trying to connect using SSLv3 and they disabled it because of the POODLE vulnerability. I'm able to connect with cURL v7.38.0 on FreeBSD 10 no problems, but not with cURL v7.29.0 on CentOS 6.5.

If it is because it's trying to connect to SSLv3, then how do I disable SSLv3 on cURL? Or is it something else?

Improve this question
2
  • 1
    Try upgrading nss.
    – jordanm
    Oct 18, 2014 at 5:16
  • 1
    An equally important thing to do is to enable curl to use TLS. Your curl does not seem capable to handle TLS protocol which is why it fell back to SSLv3 in the first place. Disabling SSLv3 will leave with a curl that won't be able to make any kind of SSL connections since your don't seem to have TLS capability. I will update this thread/comment if I am able to find something.
    – Sreeraj
    Oct 18, 2014 at 8:08

1 Answer 1

Reset to default
7

It looks like this problem is caused by the version of cURL not supporting ECC 256 bit SSL certificates and the ECDSA signature algorithm (which is used by CloudFlare). You can test to see if your version of cURL supports this encryption by running:

curl -1IsS --ciphers ecdhe_ecdsa_aes_128_sha https://sslspdy.com

If you get the following, then your cURL is out of date:

curl: (59) Unknown cipher in list: ecdhe_ecdsa_aes_128_sha

Otherwise, if it connects and doesn't display an error then it is up to date.

Since CentOS seems to thoroughly screen updates before they are applied to their packages, it's hard to say when this will be fixed. The ONLY way to get around this is by updating cURL, passing -k or --insecure won't work.

Improve this answer
3
  • Note there are negotiation issues also. I.E. specifying the --ciphers as you do above works, but that's currently required
    – Pádraig Brady
    Oct 21, 2014 at 11:46
  • Thanks for this answer. I'm using CentOS 6.6 nine months later, and it's still causing a problem. At least now I know why.
    – Dejay Clayton
    Jul 15, 2015 at 20:00
  • I'm running CentOS v7.1.1503 (with all updates up to July 15, 2015) and cURL works ONLY if --ciphers ecdhe_ecdsa_aes_128_sha is specified. Otherwise, it gives the error NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP)
    – SameOldNick
    Jul 16, 2015 at 1:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .