Java SSLHandshakeException: No Cipher Suites in Common

Luke Hebert

- 2 minutes read - 282 words

You’re hitting SSLHandshakeException: No cipher suites in common and the logs are full of “Ignoring unavailable cipher suite” lines. The most frequent root cause is initializing your SSLContext with a null KeyManager array, which silently strips every certificate-based cipher suite from the negotiation pool.

Important

You’re initializing your SSLContext with a null KeyManager array.

The key manager is what handles the server certificate (on the server side), and this is what you’re probably aiming to set when using javax.net.ssl.keyStore.

However, as described in the JSSE Reference Guide, using null for the first parameter doesn’t do what you might expect:

If the KeyManager[] parameter is null, then an empty KeyManager will be defined for this context. If the TrustManager[] parameter is null, the installed security providers will be searched for the highest-priority implementation of the TrustManagerFactory, from which an appropriate TrustManager will be obtained. Likewise, the SecureRandom parameter may be null, in which case a default implementation will be used.

An empty KeyManager doesn’t contain any RSA or DSA certificates. Therefore, all the default cipher suites that would rely on such a certificate are disabled. This is why you get all those “Ignoring unavailable cipher suite” messages, which ultimately result in a “no cipher suites in common” error.

Common Causes

When the error does appear, one of the following is almost always the trigger:

  1. The certificates present in the Keystore or Truststore are all invalid.
  2. A path to the Keystore or Truststore is invalid.
  3. The path provided to the Keystore or Truststore is valid but inaccessible due to permissions or some other issue.
  4. A password provided for a Keystore or Truststore is invalid.

References