SSL_ERROR_NO_CYPHER_OVERLAP in Firefox: no shared cipher suite

SSL_ERROR_NO_CYPHER_OVERLAP means Firefox and the server could not find a single cipher suite they both support. The handshake stops at the first step. Usually the server's cipher list is outdated or misconfigured; sometimes Firefox's own cipher preferences were changed.

Is it the site or your device?

Usually the site's cipher list is outdated; a changed Firefox setting is the local exception. Check the server's cipher list with the SSL checker:

curl ssl.sh/example.com

• The checker cannot negotiate either, or lists only weak ciphers: the server needs an update.
• The checker connects fine with modern ciphers: check Firefox. In about:config, search security.ssl3. and look for modified (bold) entries set to false. Also check about:policies for an enterprise policy that disables ciphers, and test from Troubleshoot Mode.

Causes

1. Server only offers obsolete ciphers

Configurations copied from old guides may list only RC4, 3DES or other legacy suites that Firefox no longer offers. Test what the server accepts:

openssl s_client -connect example.com:443 -servername example.com -tls1_2 \
  -cipher 'ECDHE+AESGCM:ECDHE+CHACHA20' </dev/null 2>&1 | grep -E "Cipher|alert"

If that fails while the server responds to other requests, its cipher list lacks modern suites.

2. Cipher list does not match the certificate type

An ECDSA certificate with only RSA-authenticated TLS 1.2 suites, or an RSA certificate with only ECDSA suites, leaves nothing usable. Include both families or rely on TLS 1.3.

3. Firefox cipher preferences changed

Privacy or "hardening" guides sometimes disable suites through security.ssl3.* preferences. Disabling too many breaks sites that only offer one or two suites.

4. Old appliance or embedded server

Some devices implement only a few suites. Firmware updates are the only clean fix.

5. Interception product with limited ciphers

A proxy that intercepts HTTPS may present a narrower cipher list to Firefox than the real server would.

What it looks like in each browser

How site owners fix it

A current cipher configuration with TLS 1.2 and 1.3 suites fixes it.

1. Use a current cipher configuration. Nginx example for TLS 1.2 plus TLS 1.3 defaults:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;

2. Look up unfamiliar names with the cipher suite lookup before keeping or removing them.

3. Reload and verify. Run nginx -t && systemctl reload nginx, then curl ssl.sh/example.com to confirm modern suites are negotiated.