trying to make a secure connection to a website, I get the error "ERR_SSL_VERSION_OR_CIPHER_MISMATCH"

Question

I have a problem on one of support guys' pc. every time that he tries to browse a website, he gets this error "ERR_SSL_VERSION_OR_CIPHER_MISMATCH" in Chrome and Microsoft Edge but don't have this problem in Firefox. do you have any idea how to fix this issue?

Answer 1

I got ERR_SSL_VERSION_OR_CIPHER_MISMATCH (chrome) or SSL_ERROR_NO_CYPHER_OVERLAP (firefox) for example on accessing the URL https://sesion.telecom.com.ar/.

Disabling TLS 1.3 downgrade hardening in Chrome helped:

This option enables the TLS 1.3 downgrade hardening mechanism. This hardens TLS 1.3 connections while remaining compatible with TLS 1.0 through 1.2 connections. Firewalls and proxies that do not function when this is enabled do not implement TLS 1.0 through 1.2 correctly or securely. They must be fixed by vendors. – Mac, Windows, Linux, Chrome OS, Android

To disable and re-enable it open following URL in Chrome (works for version 74, but not for canary version 76): chrome://flags/#enforce-tls13-downgrade

In Firefox goto about:config and search for security.tls.version.fallback-limit set it temporarily to 1.

Make sure to turn it back again later.

Answer 2

The problem is most likely that the server is using outdated ciphers that the browsers stopped supporting due to being insecure. The browsers apply these fixes at different times so that's why sometimes it doesn't work in one browser (the most up to date) but works on the rest of them (yet to be updated).

The real solution is to fix the ciphers used on the server side. But sometimes you can't do that and you still need to access it.

In that case, and if you are willing to take the risk of using an outdated cipher, you might try disabling the enforcement of the new ciphers e.g: By disabling "TLS 1.3 downgrade hardening" in Chrome, like other answers suggested.