ERR SSL VERSION OR CIPHER MISMATCH on subdomains

[kevinschulz87]

Hi all,

I’m getting ERR_SSL_VERSION_OR_CIPHER_MISMATCH when trying to connect to my website.

The setup

• 1 A-Record handling the “root”-domain: example.com
  -1 A-Record handling a sub-domain (which is hosted on a different server): sub.example.com
• Multiple CNAME-Records e.g. “dev” which point to “sub.example.com”
• Full (strict) Cloudflare-HTTPS
• Let’s Encrypt wildcard certificate on my server covering “*.sub.example.com”
• Cloudflare Proxy enabled for all the records

Debugging attempts
Without using Cloudflare Proxy everything works fine, so dev.sub.example.com brings me where I want to go; enabling it breaks it and I get the above mentioned error. Tested for A- and CNAME-Records.
Pinging “dev.sub.example.com” works perfectly fine giving me a Cloudflare IP when Proxied.

So I guess my question is: does the Cloudflare Proxy not work with multiple levels of subdomains?

Any suggestions are highly appreciated!
Thank you.

[domjh]

Hi @kevinschulz87,

@kevinschulz87

oes the Cloudflare Proxy not work with multiple levels of subdomains

It does, but with additional configuration. See

Subdomain too deep

This tutorial covers a possible reason for the SSL_ERROR_NO_CYPHER_OVERLAP and ERR_SSL_VERSION_OR_CIPHER_MISMATCH errors (Firefox and Chrome respectively) when seen on a subdomain. The Cloudflare universal certificates cover example.com and *.example.com. This means that it covers any subdomain one level below the domain you signed up with. It will cover www.example.com and subdomain.example.com, as these are one level below the root domain, example.com. The certificate will not cover www.sub…

[kevinschulz87]

Exactly what I needed, thank you so much !