tls: no cipher suite supported by both client and server about caddy

[jaredfolkins]

The http2 library is very specific about what cipher suites are allowed.

https://github.com/bradfitz/http2/blob/b6255645465a25b25f804acb9b3a54009e80c2a4/server.go#L228-L302

If you are getting this error on a large network I would wonder about some sort of MITM device. An IDS or IPS that is trying to force its requirements on the connection.

Out of curiosity, if you change the ssl port to a non default port (22443) and try to connect, what happens?

Jared

[mholt]

As soon as I can try, I will let you know, because that's a good idea. I know for a fact that the campus is using an SSL proxy (grrr but oh well). And thanks for the link, I hadn't noticed that before. And I would think immediately that must be it, except that I can load https://http2.golang.org just fine on campus. Wonder if it has something to do with SNI...

[mholt]

I'm going to close this for now. I think it's out of our control which ciphers the clients/MITM support. And I haven't heard anyone else have the same problem.

[dobbs]

I ran into this error tonight while trying to add a new virtual host in my Caddyfile

2017/12/08 04:56:24 [ERROR] Maintaining newly-loaded certificate for EXAMPLE.COM get directory at 'https://acme-v01.api.letsencrypt.org/directory': failed to get json "https://acme-v01.api.letsencrypt.org/directory": Get https://acme-v01.api.letsencrypt.org/directory: x509: failed to load system roots and no roots provided
2017/12/08 04:56:24 http: TLS handshake error from IP-ADDRESS:57270: tls: no cipher suite supported by both client and server

I run caddy in a docker container (alpine base image). I was able to correct the problem like this:

docker exec -it --user root THE-CONTAINER-ID sh
apk add ca-certificates
exit
docker restart THE-CONTAINER-ID

I think that the root certificates baked into my docker image are out of date. The final message about no cipher suite seems misleading. The error immediately before it about roots is what made me think to update the ca-certificates.

[francislavoie]

Yeah, I think it's generally accepted that you need to install ca-certificates or something that requires it if you need to do any networking with HTTPS from inside a container. For example, see https://github.com/abiosoft/caddy-docker/blob/master/Dockerfile (probably the most popular Caddy docker image), which installs git, which has a dependency of libcurl, which has a dependency of ca-certificates. (see here: https://pkgs.alpinelinux.org/package/v3.6/main/x86_64/git)