[Missing Ciphers] 18 Update 6/7/7a

[Ramalama]

Hi, the default Ciphers that are shipped with that 3CX Updates are:

/var/lib/3cxpbx/Bin/nginx/conf/snippets/50-ssl-protocols.conf

ssl_protocols TLSv1.2;

ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA';

Which leads to an Error if you open the Admin UI in Edge/Chrome: ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Im just wondering that no one reports that.

However a fix is simple, simply adding EECDH+AESGCM:EDH+AESGCM to the ciphers will fix it.
Ive added additionally tls 1.3, because why not.

ssl_protocols TLSv1.3 TLSv1.2;

ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA';

-----------------------------------

The Problem is why im creating this thread is because, everytime im updating 3CX, i have to edit the ciphers also... Because every update replaces the Ciphers back to the default ones which arent working.
Cheers

 

[JohnS_3CX]

Have you checked whether your SSL certificates have expired first?

 

[Ramalama]

Have you checked whether your SSL certificates have expired first?

ERR_SSL_VERSION_OR_CIPHER_MISMATCH
Is clearly not an expiration error....

But to answer the question, the certificate is valid.

 

[JohnS_3CX]

Send me a private message with your FQDN and key and I can help out checking a couple of things.

 

[SteveITS]

no one reports that.

Not actually seeing it... Does your org have specific ciphers configured for Chrome? Antivirus or firewall with HTTPS scanning? Is QUIC enabled (chrome://flags/#enable-quic)? and if so try disabling it.

 

[bitn2]

firewall with HTTPS scanning

That could be the Problem

 

[Ramalama]

Not actually seeing it... Does your org have specific ciphers configured for Chrome? Antivirus or firewall with HTTPS scanning? Is QUIC enabled (chrome://flags/#enable-quic)? and if so try disabling it.

QUIC is set to "default"
Im not using AD/DC or any rules associated to that,
Antivirus is the default "Windows Defender" with Windows 11
No Firewall filtering/m2m/etc...

Happens in Chrome and Edge, i didnt tested Firefox tho.
Adding EECDH+AESGCM:EDH+AESGCM fixes it entirely.

Cheers

 

[Ramalama]

That could be the Problem

An opnsense is inbetween the both networks (Vlan26/192.168.26.xxx and Vlan27/192.168.27.xxx), there arent any rules other as "Allow All" basically between the both networks.
Vlan26 is simply an Voip Vlan and Vlan27 is basically the Client Vlan.

But however, nothing else as routing happens there.
Not even DPI or anything else...

 

[bitn2]

An opnsense is inbetween the both networks (Vlan26/192.168.26.xxx and Vlan27/192.168.27.xxx), there arent any rules other as "Allow All" basically between the both networks.
Vlan26 is simply an Voip Vlan and Vlan27 is basically the Client Vlan.

But however, nothing else as routing happens there.
Not even DPI or anything else...

Are you sure that the firewall is not doing https inspection. That problem sounds like that and no one else got the problem.

 

[Ramalama]

Are you sure that the firewall is not doing https inspection. That problem sounds like that and no one else got the problem.

I don't think that opnsense has even that functionality, that's more a thing of sophos/cisco/etc firewalls.

However, thanks to John im a Step closer, im just waiting for a vanilla nginx.conf and 50-ssl-ciphers.conf to compare with mine.

I think that one of those isn't updated or something.

 

[bitn2]

I don't think that opnsense has even that functionality, that's more a thing of sophos/cisco/etc firewalls.

However, thanks to John im a Step closer, im just waiting for a vanilla nginx.conf and 50-ssl-ciphers.conf to compare with mine.

I think that one of those isn't updated or something.

For sure Opensense has https inspektion: https://docs.opnsense.org/manual/how-tos/proxytransparent.html

 

[Ramalama]

For sure Opensense has https inspektion: https://docs.opnsense.org/manual/how-tos/proxytransparent.html

Nice to know!
But yeah im not using that

 

[bitn2]

Check your certificate who is it from Lets Encrypt or something else.

 

[Ramalama]

Check your certificate who is it from Lets Encrypt or something else.

Its from Letsencrypt.

bitn2, give me a bit time to inspect, i will find the issue myself and reply back.

The answer i wanted to know in general was:
- "Im just wondering that no one reports that."

And it indeed seems like only i am affected, which means clearly that i fucked something up and need to check myself

But thanks to everyone for the help!
When i get a littlle time, i will look into it and reply back what the issue was!

 

[SweetAction]

I did a

cat /var/lib/3cxpbx/Bin/nginx/conf/snippets/50-ssl-protocols.conf

and got back the same as your OP, specifically:

ssl_protocols TLSv1.2;

ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA';

We don't have any errors, so I will throw my hat into the ring with everyone else here - it's something else on your network or machine. Changing the file to add the additional ciphers may solve it, but it's not the cause and you should look elsewhere.

As a test you could put a PC on the same VLAN as 3CX so that it isn't being routed by your L3 device and see if the issue remains in a stock config. You could also install a blank windows vm and use a default chrome config to test.

 

[Ramalama]

I did a

cat /var/lib/3cxpbx/Bin/nginx/conf/snippets/50-ssl-protocols.conf

and got back the same as your OP, specifically:

ssl_protocols TLSv1.2;

ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA';

We don't have any errors, so I will throw my hat into the ring with everyone else here - it's something else on your network or machine. Changing the file to add the additional ciphers may solve it, but it's not the cause and you should look elsewhere.

As a test you could put a PC on the same VLAN as 3CX so that it isn't being routed by your L3 device and see if the issue remains in a stock config. You could also install a blank windows vm and use a default chrome config to test.

John sended me his nginx.conf and 50-ssl-ciphers, which are identical to mine, i did a diff...
However i get ofc the error.

I just moved my PC into the 3CX Vlan, so no routing is in-between, however I'll get the same cipher Error with Firefox/Chrome/Edge.

Now it can actually be only an Window issue.
- 1. Computer: W11 Professional (22H2 Build 22621.1702)
- 2. Computer: W10 Professional (22H2 Build 19045.2965)
- 3. Computer: W11 Professional (22H2 Build 22621.1702)

All 3 get the error.
The nginx and 50-ssl configs are Stock. (Identical to John's)
No AD/DC, no group policy, windows defender as Firewall/Antivirus, no special Apps.
No router in-between, 3cx and PCs are in the same Vlan.

I'll quess i have to spin up an W11 VM now and check with stock windows, because it's getting super weird now.