SSL_ERROR_NO_CYPHER_OVERLAP

domain: bayon.et

i dont really have any other info other than the fact that i had some errors that said "failed to verify txt" in the edge certificate area

Wwiz on lick domain: bayon.et i dont really have any other info other than the fact that i h...

Chaika•2/12/24, 9:29 PM

et

et

is a really silly TLD which has CAA records at its root (they're bad, that's bad behavior)
;; QUESTION SECTION:
;et. IN CAA

;; ANSWER SECTION:
et. 0 IN CAA 0 issue "sectigo.com"
et. 0 IN CAA 0 issue "digicert.com "
et. 0 IN CAA 0 issuewild "sectigo.com"
et. 0 IN CAA 0 issuewild "digicert.com "
et. 0 IN CAA 0 issue "letsencrypt.org"
et. 0 IN CAA 0 issue "entrust.net"
et. 0 IN CAA 0 issue "gandi.net"
et. 0 IN CAA 0 issuewild "entrust.net"
et. 0 IN CAA 0 wildcard "sectigo.com"

I bet the Universal SSL is trying to issue a Google/GTS one, and it's failing? You'll need to create a CAA record for

pki.goog

pki.goog

on your root (

)

wiz on lickOP•2/12/24, 9:32 PM

How

wiz on lickOP•2/12/24, 9:32 PM

@Chaika

Wwiz on lick @Chaika

Chaika•2/12/24, 9:33 PM

navigate to your website in Cloudflare -> DNS -> Records, create this:

Chaika•2/12/24, 9:34 PM

once you create one, CF should automatically create all of the others (virtually, you won't see them in your dashboard). and having ones set for your site override the ones set by your tld/.et

Chaika•2/12/24, 9:34 PM

What's the status of the universal ssl cert under SSL/TLS -> Edge Certificates? If it's timed out, you'll need to disable Universal SSL, wait for a few minutes, and re-enable to have it try again

wiz on lickOP•2/12/24, 9:34 PM

i assume if i have subdomains i also have to do this too?

Chaika•2/12/24, 9:34 PM

no, it'll use the one on your root

wiz on lickOP•2/12/24, 9:34 PM

roger ill lyk

Chaika•2/12/24, 9:35 PM

although you could set ones in subdomains to override them, if you wanted to. Just like how you're creating these to override the ones on .et

wiz on lickOP•2/12/24, 9:35 PM

alright thanks ill lyk if i have any more issues

CChaika What's the status of the universal ssl cert under SSL/TLS -> Edge Certificates? ...

wiz on lickOP•2/12/24, 9:36 PM

doing this rn as it was "timed out"

Chaika•2/12/24, 9:37 PM

It'd be nice if CF understood

.et

.et

is being silly and has those set and deployed those for you, hopefully one day. It's just not something they should be doing though.
I see your domain now has all the CAA records it needs

CChaika It'd be nice if CF understood `.et` is being silly and has those set and deploye...

wiz on lickOP•2/12/24, 9:37 PM

yeah would be ideal, in all my time doing stuff like this ive never seen an cypther overlap error

wiz on lickOP•2/12/24, 9:37 PM

and tbh the info online is kinda terrible

wiz on lickOP•2/12/24, 9:37 PM

its also weird, it used to work just fine, so im curious how this happened

Chaika•2/12/24, 9:38 PM

CF uses cypher overlap error primarily to signal that they don't have a certificate to serve for that request/make tls work

Wwiz on lick its also weird, it used to work just fine, so im curious how this happened

Chaika•2/12/24, 9:38 PM

for that same et domain, with ssl? Perhaps it was done before .et decided to create those caa records? Not sure when they were added, been at least a few months though

wiz on lickOP•2/12/24, 9:39 PM

3 weeks ago was when the issue started

wiz on lickOP•2/12/24, 9:39 PM

same domain, certbot, same thing

wiz on lickOP•2/12/24, 9:39 PM

i renewed my cert then it gave me the issue

wiz on lickOP•2/12/24, 9:39 PM

so maybe because the certs were 2 and a half months old, they didnt require this weird CAA stuff?

Chaika•2/12/24, 9:41 PM

It looks like nov of 2023 .et added the caa records

Chaika•2/12/24, 9:41 PM

you still have an _acme-challenge txt record, is that from certbot?

CChaika you still have an _acme-challenge txt record, is that from certbot?

wiz on lickOP•2/12/24, 9:50 PM

i do?

wiz on lickOP•2/12/24, 9:51 PM

not on my end

wiz on lickOP•2/12/24, 9:51 PM

https://cdn.discordapp.com/attachments/1204438813695545437/1206719207627300956/image.png?ex=65dd07d6&is=65ca92d6&hm=b47ada2a096046c6f0558107850fab8d50e2ff7d5229498f579d220007ad4a52&

Chaika•2/12/24, 9:52 PM

must be one of the ones from it automagically trying to issue then. You disabled and re-enabled? It looks like it's still struggling, maybe ratelimited by failures

wiz on lickOP•2/12/24, 9:53 PM

yeah i disabled and just renabled it at :42

wiz on lickOP•2/12/24, 9:53 PM

so just over 5 mins

wiz on lickOP•2/12/24, 9:53 PM

still says "pending validation (txt)"

Chaika•2/12/24, 9:54 PM

what's the issuer/authority its trying to use when you expand the cert?

wiz on lickOP•2/12/24, 9:56 PM

Chaika•2/12/24, 9:57 PM

no I mean in Cloudflare under ssl/tls -> edge certs

Chaika•2/12/24, 9:57 PM

should be able to expand the one its trying to issue

wiz on lickOP•2/12/24, 9:57 PM

google trust

Chaika•2/12/24, 9:57 PM

well the caa records of .et would def have been blocking that before lol

wiz on lickOP•2/12/24, 9:57 PM

i think its trying to do it now, as its now showing the txt records n stuff when i expand it

Wwiz on lick i think its trying to do it now, as its now showing the txt records n stuff when...

Chaika•2/12/24, 10:09 PM

looks like it did it/issued properly

CChaika looks like it did it/issued properly

wiz on lickOP•2/12/24, 10:30 PM

yep, cool thanks appreciate it, do you know if this will affect my emails btw ?

Wwiz on lick yep, cool thanks appreciate it, do you know if this will affect my emails btw ?

Chaika•2/12/24, 10:34 PM

All Cloudflare does for mail is just DNS. ssl cert/etc doesn't matter, just make sure its unproxied. Which it looks like it is

wiz on lickOP•2/12/24, 10:35 PM

yep okay cool

wiz on lickOP•2/12/24, 10:35 PM

thanks g

SSL_ERROR_NO_CYPHER_OVERLAP

Similar Threads

Similar Threads

Similar Threads