Google cloud HTTPs ERR_SSL_VERSION_OR_CIPHER_MISMATCH

user_13811146 0
Viewed 6415

I followed this tutorial https://cloud.google.com/storage/docs/hosting-static-website

But I am not able to reach the site on https because of ERR_SSL_VERSION_OR_CIPHER_MISMATCH / SSL_ERROR_NO_CYPHER_OVERLAP depending on the browser

I use managed certificate provided by google, but no browser seems to be compatible with it. I use GCP default SSL policy, but I also tried create one for testing with minimal requirements of TSL 1.0, but nothing changed.

google-cloud-platform
3 Answers

Yes , if using google managed cert sometimes it takes time to propagate to your associate domain , so in future you could eiter use "curl" command or used dig command to verify it , sometimes it takes 24 hrs too which is maximum time.

user_136173530

Please verify following points:

  1. verify your website pointing towards frontend LB
  2. check the state of google managed cert added on the front end of LB
  3. verify that frontend is using HTTPS and backend is using HTTP
  4. verify your ssl cert
user_136173530

I'm sure it's a problem with the DNS server. If your config is correct, you have to wait a few hours more and redeploy again.

In my case, I was setting up a subdomain with different IP used in the domain. My managed certificate it was something like this:

apiVersion: networking.gke.io/v1beta1
kind: ManagedCertificate
metadata:
  name: my-certificate
spec:
  domains:
    - www.sub.example.com

My ingress was fine:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
      kubernetes.io/ingress.global-static-ip-name: st-ext-ip-prod
      networking.gke.io/v1beta1.FrontendConfig: ssl-redirect
      networking.gke.io/managed-certificates: my-certificate
spec: ...

The problem was the configuration in my DNS SERVER. In my certificate, I was using the domain starting with wwww but in my server, I didn't have the CNAME to support the www.sub

@      A     DOMAIN-IP
www  CNAME   example.com

sub        A     SUBDOMAIN-IP
www.sub  CNAME   sub.example.com

Doing that configuration (CNAME for www.sub) I had to wait like 5 hours (it could take more) I had to redeploy everything from the beginning and finally, I didn't have that issue ERR_SSL_VERSION_OR_CIPHER_MISMATCH again.

user_102996040
Related