4 ms·

Secure Connection Failed An error occurred during a connection to www.backblaze.com. Cannot communicate securely with peer: no common encryption algorithm(

by k1t 12y ago

Secure Connection Failed An error occurred during a connection to www.backblaze.com. Cannot communicate securely with peer: no common encryption algorithm(s). (Error code: ssl_error_no_cypher_overlap) Oh dear, please upgrade your SSL certs.

duskwuff 12y ago
This has nothing to do with the SSL certificate. The site is configured to use RC4, which used to be the recommended cipher to avoid certain attacks (particularly BEAST). However, RC4 has other weaknesses, and this is no longer recommended. Current versions of Firefox will actually refuse to negotiate an RC4 connection.
- sp332 12y ago
  Doesn't that mean that the certificate is using the outdated RC4 cipher, and should be updated?
  - skuhn 12y ago
    No, the SSL cert does not use RC4. RC4 is a block cipher which is used to encrypt data transferred between your browser and the server, akin to AES. Backblaze does need to step it up in terms of their SSL configuration [1], particularly if this is indicative of their configuration for actual file transfer (no idea though). If I had to guess, they're using their OS's OpenSSL and thus trapped on 0.9.8 or 1.0.0 (both of which do not support TLS v1.2) and maybe haven't spent much time tuning the config lately. A lot of places are afraid of diverging from their OS vendor's version of OpenSSL, but I personally think it is a mistake to get stuck in time with such a crucial component. Likewise if your service is built around nginx -- are you going to stick with whatever RHEL 5 shipped for 8 years? [1] https://www.ssllabs.com/ssltest/analyze.html?d=www.backblaze.com https://www.ssllabs.com/ssltest/analyze.html?d=www.backblaze...
    - WatchDog 12y ago
      RC4 is a stream cipher, not a block cipher.
miduil 12y ago
@brianwski (or any other backblaze volunteer) We still can't visit your website. https://news.ycombinator.com/item?id=8999036 https://news.ycombinator.com/item?id=8999036 It's been about a month ago we mentioned this issue.

by k1t 12y ago

duskwuff 12y ago

This has nothing to do with the SSL certificate. The site is configured to use RC4, which used to be the recommended cipher to avoid certain attacks (particularly BEAST). However, RC4 has other weaknesses, and this is no longer recommended. Current versions of Firefox will actually refuse to negotiate an RC4 connection.

sp332 12y ago
Doesn't that mean that the certificate is using the outdated RC4 cipher, and should be updated?
- skuhn 12y ago
  No, the SSL cert does not use RC4. RC4 is a block cipher which is used to encrypt data transferred between your browser and the server, akin to AES. Backblaze does need to step it up in terms of their SSL configuration [1], particularly if this is indicative of their configuration for actual file transfer (no idea though). If I had to guess, they're using their OS's OpenSSL and thus trapped on 0.9.8 or 1.0.0 (both of which do not support TLS v1.2) and maybe haven't spent much time tuning the config lately. A lot of places are afraid of diverging from their OS vendor's version of OpenSSL, but I personally think it is a mistake to get stuck in time with such a crucial component. Likewise if your service is built around nginx -- are you going to stick with whatever RHEL 5 shipped for 8 years? [1] https://www.ssllabs.com/ssltest/analyze.html?d=www.backblaze.com https://www.ssllabs.com/ssltest/analyze.html?d=www.backblaze...
  - WatchDog 12y ago
    RC4 is a stream cipher, not a block cipher.

miduil 12y ago

@brianwski (or any other backblaze volunteer) We still can't visit your website. https://news.ycombinator.com/item?id=8999036 https://news.ycombinator.com/item?id=8999036 It's been about a month ago we mentioned this issue.