Chrome opens the same site but Firefox shows SSL_ERROR_NO_CYPHER_OVERLAP. Why?

Firefox ships its own protocol and cipher policy through NSS, and it dropped TLS 1.0/1.1 by default in Firefox 78 (June 2020). If the server only offers those old protocols or ciphers Firefox has removed, Firefox has nothing to negotiate while a differently configured Chrome build may still connect. The server is the shared problem; the browsers just disagree on how strict to be.

Should I set security.tls.version.enable-deprecated to true to make it work?

Only as a one-time test to confirm the diagnosis, never as a fix. Flipping that in about:config re-enables TLS 1.0/1.1 for your browser and lowers your own security while leaving every other visitor broken. Fix the protocol and cipher list on the server instead.

The certificate looks fine. Why does it still fail?

This error fires during protocol and cipher negotiation, before certificate validation runs. A perfectly valid certificate makes no difference if there is no common TLS version or cipher suite to carry it.

Views: 105

SSL_ERROR_NO_CYPHER_OVERLAP in Firefox: Fix

SSL_ERROR_NO_CYPHER_OVERLAP: Firefox and the server share no TLS version or cipher. Fix in 3 checks: protocol, cipher, SNI. Free instant check, no sign-up.

Check your domain for this issue now

Free, no sign-up. Runs the exact check this guide describes and shows what to fix.

Problem

Firefox shows SSL_ERROR_NO_CYPHER_OVERLAP and the page never loads. The connection dies during the TLS handshake — before any content, and before Firefox ever gets to a certificate warning.

Symptoms

Firefox reports SSL_ERROR_NO_CYPHER_OVERLAP; Chrome shows ERR_SSL_VERSION_OR_CIPHER_MISMATCH for the same server.
The failure is instant. You never reach the “Warning: Potential Security Risk Ahead” certificate page.
Older devices or an older Firefox may still connect while an up-to-date Firefox fails.

What This Error Actually Means

“No cypher overlap” is Firefox being literal. During the handshake the client sends the list of TLS versions and cipher suites it supports, the server picks one both sides share, and the connection continues. When that intersection is empty, NSS (Firefox’s TLS library) gives up with this exact string.

The word “cypher” in the name is a red herring — a stale protocol version triggers it just as often as a stale cipher. Firefox 78, released June 30, 2020, disabled TLS 1.0 and 1.1 by default (Mozilla first tried in Firefox 74, then re-enabled them briefly during the early COVID period, then finished the job in 78). RFC 8996 formally deprecated both protocols in 2021. So a server stuck on TLS 1.0/1.1 has no version left to share with a modern Firefox, and you get the “cipher” error even though the ciphers were never the point.

Top 3 Causes

The server only offers TLS 1.0/1.1 (or SSLv3) - Firefox removed those by default in version 78. If the origin serves nothing newer, there is no common protocol version and the handshake fails before ciphers are even compared.
Only weak or removed ciphers are offered - The server’s cipher list is limited to suites Firefox dropped, such as RC4, export-grade, or 3DES-only configurations. Nothing overlaps with Firefox’s modern default set.
No certificate for the SNI hostname - The server receives the requested name in the SNI extension, has no matching certificate, and aborts the negotiation rather than presenting one.

Diagnose with DechoNet

SSL Check to see exactly which TLS versions and cipher suites the server offers, and whether a valid certificate comes back — this tells you in seconds whether the server or the browser is the problem.
Port Check to confirm port 443 is reachable from outside your network.
HTTP Check to inspect how the HTTP-to-HTTPS redirect behaves.

Resolution Checklist

Run SSL Check first. If it reports only TLS 1.0/1.1 or a weak cipher list, the fix is server-side — do not touch about:config.
Enable TLS 1.2 and TLS 1.3 on the server, and disable SSLv3, TLS 1.0, and TLS 1.1.
Replace the cipher list with a modern set (Mozilla’s “intermediate” profile is a safe baseline) and remove RC4, 3DES, and export suites.
Confirm a certificate is installed for the exact SNI hostname Firefox is sending.
If a CDN or load balancer terminates TLS, change the protocol and cipher policy there, not only at the origin.
Re-run SSL Check and confirm TLS 1.2/1.3 with a modern cipher actually negotiate.

When to Escalate

Escalate to your CDN or managed TLS provider if you cannot edit the protocol and cipher policy directly.
If a legacy internal client genuinely needs an old protocol, treat re-enabling it as a deliberate security decision by the owner — not a quiet security.tls.version.enable-deprecated toggle on individual machines that hides the real risk.