ERR_SSL_VERSION_OR_CIPHER_MISMATCH after Letsencrypt certificate
Opened this issue · 3 comments
After running the unifi_ssl_import.sh and succesfully updating the keystore, browsers would not accept the certificate. The error displayed in Edge is ERR_SSL_VERSION_OR_CIPHER_MISMATCH, and you are unable to get to the webinterface.
To solve this I edited the "system.properties" file located in the data directory, and added this line:
unifi.https.ciphers=TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CCM,TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_CCM,TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
Since this is caused by adjusting the keystore this should be addressed here I think. This post might help other users and there might be a better way to tackle this issue. The only difference I could find within the keystores was the used encryption: Where Unifi has RSA 4069, the new one has SHA256withRSA.
Thanks for that. It hit me today and I suddenly couldn't access my Unifi Controller anymore. Adding this line did the trick and it works fine again.
@paulvanleest I logged in just to thank you for that. I migrated my unifi controller to a new server and used @stevejenkins script but got the same error and this resolved it.
Great, thanks for the credits, you are very welcome!