Firefox 31 was released yesterday, and it seems like it has a problem with SSL:

Secure Connection Failed

An error occurred during a connection to api.joeyco.com. SSL peer selected a
cipher suite disallowed for the selected protocol version.
(Error code: ssl_error_cipher_disallowed_for_version)

The page you are trying to view cannot be shown because the authenticity of
the received data could not be verified.

What I tried to resolve the problem: Update to "OpenSSL 1.0.1h 5 Jun 2014", Reinstall nginx, Reinstall PHP, Regenerate certificates.

I even went through this page. What am I missing here? How can I find out for certain if nginx is actually using the correct OpenSSL?

2 Answers 2


Actually your website has a problem of using insecure SSL ciphers.

You should configure the ciphers in your web server like this:

ssl_prefer_server_ciphers On;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;

Credit for the configration goes to https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/ .

You should also consider removing SSLv3 from ssl_protocols, since it is not that safe either. IE6 users running Windows XP won't be able to connect to your site if you have SSLv3 disabled.

  • Thanks! That fixed it. So which ssl_protocols do you recommend? Also when I check my site on digicert.com/help/index.htm it says still vulnerable to heartbleed, any idea why this could by.
    – Samer
    Jul 25, 2014 at 0:33
  • I prefer to use only the TLS protocols in ssl_protocols You should open a new question on the Heartbleed issue at ServerFault. It seems that somehow your OpenSSL upgrade hasn't worked out correctly. You should provide OS & packages information in the question. Jul 25, 2014 at 13:17

It is not recommended to mess with that global security setting, but add trusted hosts instead if you really need to.

See this link for information about 'Renegotiation' (CVE-2009-3555):

https://wiki.mozilla.org/Security:Renegotiation https://wiki.mozilla.org/Security:Renegotiation#security.ssl.renego_unrestricted_hosts

You can look at the security.ssl.renego_unrestricted_hosts pref on the about:config page and add the sites that you want to allow to the string value.

Separate multiple host names by a comma.

  • This doesn't really help in this case, because the server configuration problem affects all site users, and you cannot tell all site users to add things to trusted sites. Jul 25, 2014 at 13:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.