client failed to negotiate an ssl connection : no cipher suites in common -- burp suite

Question

Unable to tamper HTTPS request using burp suit after importing PortSwigger certificate . it given an alert 'client failed to negotiate an ssl connection : no cipher suites in common'... where as it works fine for http request.. i have tried Internet explorer, chrome, Mozilla and java 7 and 8 but did not succeeded to tamper request

score 3 · Answer 1 · answered Dec 09 '16 at 08:41

3

You need to check SSL related configurations (Project Options > SSL)

Default is "Use the default protocols and ciphers of your Java Installation".
You can change it to "Use custom protocols and ciphers". Check the supported ciphers for host you want to test using SSLScan and configure the same.
In case, it still does not work you can select "Allow unsafe renegotiation".(Once you are done with testing you can revert back to default settings).

answered Dec 09 '16 at 08:41

Savan Gadhiya

305
1
6

same issue ..after trying the above steps – zzz Dec 23 '16 at 08:34
Are you facing issues for any specific website? – Savan Gadhiya Dec 23 '16 at 16:44
Tested for mobile app and a single website.. i am facing this issue in both cases ... but when it was on http ... burp was working fine – zzz Dec 27 '16 at 07:22

Ender · Answer 2 · 2020-04-10T01:32:24.313

In your case, have you tried to download the Cert from http://burp and import it? If it does not work, try to import/export CA certification (Burp -> Proxy -> Options -> import/export CA certification -> save) and import back to your browser.

With Android, since the "traditional" way of installing a user certificate doesn't work anymore in Nougat and above, for me the easiest solution is to install the Burp CA to the system trusted certificates. You can see all the system CAs that are bundled with an Android device by going to Settings -> Security -> Trusted Credentials and viewing system CAs. You'll see the similar CAs you'd see in a browser bundle. Trusted CAs for Android are stored in a special format in /system/etc/security/cacerts. If we have root privileges, it's possible to write to this location and drop in the Burp CA (after some modification).

The precise steps to generate and import the CA is here:

score -2 · Answer 3 · answered Jun 28 '18 at 10:03

-2

I have solved that issue using below techniche

Open burp suit
Can you see Proxy Tab

2.1 Then Click on Options tab

2.2 Check for SSL Pass Through in below page listing
Add your host and port number in dialogue.

Cheers...!!! You are ready to go.

answered Jun 28 '18 at 10:03

Suraj Sonawane

2,044
1
14
24

This will passtrough the traffic without monitoring. – Mike Aron Jun 06 '20 at 17:34

client failed to negotiate an ssl connection : no cipher suites in common -- burp suite

3 Answers3