# SSL_ERROR_NO_CYPHER_OVERLAP in Firefox: no shared cipher suite

> SSL_ERROR_NO_CYPHER_OVERLAP means Firefox and the server share no cipher suite. Usually an outdated server cipher list or a changed Firefox setting.

Source: https://ssl.sh/errors/ssl-error-no-cypher-overlap/
Last updated: 2026-11-10

**SSL_ERROR_NO_CYPHER_OVERLAP means Firefox and the server could not find a single cipher suite they both support.** The handshake stops at the first step. Usually the server's cipher list is outdated or misconfigured; sometimes Firefox's own cipher preferences were changed.

## Is it the site or your device?

Usually the site's cipher list is outdated; a changed Firefox setting is the local exception. Check the server's cipher list with the [SSL checker](https://ssl.sh/tools/ssl-checker/):

```bash
curl ssl.sh/example.com
```

- **The checker cannot negotiate either, or lists only weak ciphers:** the server needs an update.
- **The checker connects fine with modern ciphers:** check Firefox. In `about:config`, search `security.ssl3.` and look for modified (bold) entries set to `false`. Also check `about:policies` for an enterprise policy that disables ciphers, and test from Troubleshoot Mode.

## Causes

### 1. Server only offers obsolete ciphers

Configurations copied from old guides may list only RC4, 3DES or other legacy suites that Firefox no longer offers. Test what the server accepts:

```bash
openssl s_client -connect example.com:443 -servername example.com -tls1_2 \
  -cipher 'ECDHE+AESGCM:ECDHE+CHACHA20' </dev/null 2>&1 | grep -E "Cipher|alert"
```

If that fails while the server responds to other requests, its cipher list lacks modern suites.

### 2. Cipher list does not match the certificate type

An ECDSA certificate with only RSA-authenticated TLS 1.2 suites, or an RSA certificate with only ECDSA suites, leaves nothing usable. Include both families or rely on TLS 1.3.

### 3. Firefox cipher preferences changed

Privacy or "hardening" guides sometimes disable suites through `security.ssl3.*` preferences. Disabling too many breaks sites that only offer one or two suites.

### 4. Old appliance or embedded server

Some devices implement only a few suites. Firmware updates are the only clean fix.

### 5. Interception product with limited ciphers

A proxy that intercepts HTTPS may present a narrower cipher list to Firefox than the real server would.

## What it looks like in each browser

| Browser | What you see |
|---|---|
| Firefox | "Secure Connection Failed" with `SSL_ERROR_NO_CYPHER_OVERLAP` |
| Chrome / Edge | [ERR_SSL_VERSION_OR_CIPHER_MISMATCH](https://ssl.sh/errors/err-ssl-version-or-cipher-mismatch/) |
| Safari | [Safari can't establish a secure connection](https://ssl.sh/errors/safari-cant-establish-secure-connection/) |
| curl | `sslv3 alert handshake failure` or `no cipher match` |

## How site owners fix it

A current cipher configuration with TLS 1.2 and 1.3 suites fixes it.

**1. Use a current cipher configuration.** Nginx example for TLS 1.2 plus TLS 1.3 defaults:

```nginx
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
```

**2. Look up unfamiliar names** with the [cipher suite lookup](https://ssl.sh/tools/cipher-suite-lookup/) before keeping or removing them.

**3. Reload and verify.** Run `nginx -t && systemctl reload nginx`, then `curl ssl.sh/example.com` to confirm modern suites are negotiated.