# Getting SL\_ERROR\_NO\_CYPHER\_OVERLAP

**URL:** <https://community.letsencrypt.org/t/getting-sl-error-no-cypher-overlap/203413>\
**Category:** Help\
**Created:** [August 12, 2023, 10:07pm UTC](https://community.letsencrypt.org/t/getting-sl-error-no-cypher-overlap/203413 "2023-08-12T22:07:11Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![SplinterFL](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@SplinterFL](https://community.letsencrypt.org/u/SplinterFL)\
**Post date:** [August 12, 2023, 10:07pm UTC](https://community.letsencrypt.org/t/getting-sl-error-no-cypher-overlap/203413/1 "2023-08-12T22:07:12Z")

</div>

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: [fta-vacations.com](http://fta-vacations.com)

I ran this command: sudo certbot renew --allow-subset-of-names

It produced this output:

My web server is (include version): APACHE2 with STUNNEL  
The operating system my web server runs on is (include version):  
My hosting provider, if applicable, is: self  
I can login to a root shell on my machine (yes or no, or I don't know): YES  
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No  
The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 2.6.0

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [August 12, 2023, 10:17pm UTC](https://community.letsencrypt.org/t/getting-sl-error-no-cypher-overlap/203413/2 "2023-08-12T22:17:52Z")

</div>

> [@SplinterFL](#):
>
> APACHE2 with STUNNEL

Oh my god.

What ciphers have you configured in stunnel?

---

<div class="post-metadata">

**Author:** ![SplinterFL](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@SplinterFL](https://community.letsencrypt.org/u/SplinterFL)\
**Post date:** [August 12, 2023, 10:21pm UTC](https://community.letsencrypt.org/t/getting-sl-error-no-cypher-overlap/203413/3 "2023-08-12T22:21:47Z")

</div>

ciphers =  
EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:  
+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:  
+SSLv3:!aNULL!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:  
CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [August 12, 2023, 10:25pm UTC](https://community.letsencrypt.org/t/getting-sl-error-no-cypher-overlap/203413/4 "2023-08-12T22:25:19Z")

</div>

try with

```plaintext
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305

```

from [Mozilla SSL Configuration Generator](https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.7)

---

<div class="post-metadata">

**Author:** ![SplinterFL](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@SplinterFL](https://community.letsencrypt.org/u/SplinterFL)\
**Post date:** [August 12, 2023, 10:27pm UTC](https://community.letsencrypt.org/t/getting-sl-error-no-cypher-overlap/203413/5 "2023-08-12T22:27:47Z")

</div>

> [@9peppe](#):
>
> `ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305`

THANK YOU!!! I've been pulling my hair out, thinkgin it was X1 or X2 CA cert issue.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [September 11, 2023, 10:27pm UTC](https://community.letsencrypt.org/t/getting-sl-error-no-cypher-overlap/203413/6 "2023-09-11T22:27:58Z")

</div>

Closed on September 11, 2023, 10:27pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.