title: Tomcat 6 ERR_SSL_VERSION_OR_CIPHER_MISMATCH / ssl_error_no_cypher_overlap
body: <p>I’ve trouble to use a browser for accessing my SSL/TLS enabled tomcat-6.0.36-windows-x64 server. It works fine with openssl but not with any browser. </p>
  
  <p>Initializing looks fine:</p>
  
  <p><code>16.01.2013 16:45:09 org.apache.coyote.http11.Http11AprProtocol init</code></p>
  
  <p><code>INFO: Initializing Coyote HTTP/1.1 on http-8443</code></p>
  
  <p>Also openSSL:
  <code>openssl s_client -tls1 -connect localhost:8443:</code>
  Result:</p>
  
  <p><code>New, TLSv1/SSLv3, Cipher is ECDH-ECDSA-AES256-SHA</code></p>
  
  <p><code>Server public key is 256 bit</code></p>
  
  <p><code>Secure Renegotiation IS supported</code></p>
  
  <p><code>Compression: NONE</code></p>
  
  <p><code>Expansion: NONE</code></p>
  
  <p><code>SSL-Session:</code></p>
  
  <pre><code>Protocol  : TLSv1
  </code></pre>
  
  <p><code>Cipher    : ECDH-ECDSA-AES256-SHA</code></p>
  
  <p>Only web-browsers don’t work: </p>
  
  <p><strong>Firefox 15.0.1 says: ssl_error_no_cypher_overlap</strong></p>
  
  <p><strong>Chrome 24.0.1312.52 m: ERR_SSL_VERSION_OR_CIPHER_MISMATCH</strong></p>
  
  <p>That’s the tomcat configuration: </p>
  
  <p><code>Connector port="8443" maxHttpHeaderSize="8192"<br>
      protocol="org.apache.coyote.http11.Http11AprProtocol"
             maxThreads="150"
             scheme="https" 
             secure="true"<br>
             SSLProtocol="all"<br>
             enableLookups="false" 
             disableUploadTimeout="true"
             acceptCount="100" 
             SSLEnabled="true"
             SSLCertificateFile="../ecc_servercert.crt"
             SSLCertificateKeyFile="../ec_serverkey.pem"</code></p>
  
  <p>The certificate is based on a ecliptic curves algorithm: </p>
  
  <p><code>openssl ecparam -out c:\ecc\ec_serverkey.pem -name secp256k1 -genkey</code></p>
  
  <p><code>openssl req -new -x509 -nodes -days 365 -key c:\ecc\ec_serverkey.pem -out  c:\ecc\ecc_servercert.crt</code></p>
  
  <p>Hope someone has an idea? Accourding to hours of searching, the browers should support this configuariton ... </p>
  
  <p>Ragards, Tobi </p>