Cloudflare Developers•2y ago•

16 replies

Tunnel - no common encryption algorithm(s)

Sorry to bother - So I added another hostname to my tunnel configuration, saved it. Restarted cloudflared.

Now when I navigate to that domain, I get:

An error occurred during a connection to [redact].foobar.us. Cannot communicate securely with peer: no common encryption algorithm(s).

© 2026 Hedgehog Software, LLC

More

Communities Docs About Terms Privacy

colemickens_ds

C

colemickens_dsOP•2/12/24, 6:29 PM

the first/original public hostname I added works fine.

colemickens_ds

C

colemickens_dsOP•2/12/24, 6:41 PM

It sounds like you tried to put your GitLab on a second-level or deeper subdomain (i.e gitlab.internal.example.com) when the Universal SSL Cert (the one Cloudflare gives you for free) only covers first-level subdomains (like gitlab.example.com). You can get around this by purchasing Advanced Certificate Manager (ACM) and turning on Total TLS or issuing an Adv. Cert for that deeper subdomain, or just by moving your Gitlab to a 1st level subdomain like shown in the tutorial.

colemickens_ds

C

colemickens_dsOP•2/12/24, 6:41 PM

sigh, okay

colemickens_ds

C

colemickens_dsOP•2/12/24, 6:41 PM

it would be soooo nice if this was presented to me when I added the public hostname

colemickens_ds

C

colemickens_dsOP•2/12/24, 8:53 PM

There's really no other option here?

colemickens_ds

C

colemickens_dsOP•2/12/24, 8:53 PM

I need to proxy minio through and s3 clients expect to prepend the region as a subdomain

colemickens_ds

Ccolemickens_ds I need to proxy minio through and s3 clients expect to prepend the region as a s...

Chaika

C

Chaika•2/12/24, 9:14 PM

use path style instead of virtual host style?

Chaika

C

Chaika•2/12/24, 9:15 PM

Otherwise you'd need a wildcard for virtual host style, so $10/m for ACM would be your only choice afaik

colemickens_ds

C

colemickens_dsOP•2/12/24, 9:15 PM

I looked to see if I could, but I think s3 deprecated that, quite a while ago.

Chaika

C

Chaika•2/12/24, 9:15 PM

They said they planned to, but delayed it and never re-scheduled it

Chaika

C

Chaika•2/12/24, 9:15 PM

https://aws.amazon.com/blogs/aws/amazon-s3-path-deprecation-plan-the-rest-of-the-story/

colemickens_ds

C

colemickens_dsOP•2/12/24, 9:15 PM

I see. I thought I had used them more recently

colemickens_ds

C

colemickens_dsOP•2/12/24, 9:16 PM

I need to look harder at my s3 client config then.

Chaika

C

Chaika•2/12/24, 9:16 PM

there's no current date, and they say when they do pick one, they'll give a full year

colemickens_ds

C

colemickens_dsOP•2/12/24, 9:18 PM

yeah, right in my face: https://docs.rs/aws-sdk-s3/latest/aws_sdk_s3/config/struct.Builder.html#method.force_path_style

Builder in aws_sdk_s3::config - Rust

Builder for creating a

Config

Config

.

colemickens_ds

C

colemickens_dsOP•2/12/24, 9:18 PM

thank you @Chaika this will likely do the trick