We fixed this by commenting out line 377 in downloader/lib/Mage/HTTP/Client/Curl.php

//$this->curlOption(CURLOPT_SSL_CIPHER_LIST, 'TLSv1')

There may be a setting that lets this pass through but we did not get that far.

  • 3
    You really should fix your web server. – benmarks Jul 9 '15 at 20:43
  • I tried this; didn't work. I also used the other solutions about, and nothing seemed to solve it. Any ideas? – harley_woop Jul 15 '15 at 7:08
  • it worked for me. – Bikram Shrestha Nov 29 '15 at 9:13
  • @benmarks It's actually a bug in magento expecting curl/openssl instead of curl/nss... see below – Ray Foss Jun 4 '17 at 14:54

There's two things that would likely cause this.

  1. You aren't using OpenSSL
  2. Your OpenSSL build is out of date

To solve 1.

Check that you aren't using OpenSSL,

php -r "print_r(curl_version());" | grep ssl_version

If it displays anything other than OpenSSL - then that's your answer. The solution would be to remove/comment the line in question.


To Solve 2.

It sounds like your OpenSSL library is out of date.

Eg. A typical web server would show,

openssl ciphers | tr ':' '\n'
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-SHA384
ECDHE-ECDSA-AES256-SHA384
ECDHE-RSA-AES256-SHA
ECDHE-ECDSA-AES256-SHA
SRP-DSS-AES-256-CBC-SHA
SRP-RSA-AES-256-CBC-SHA
SRP-AES-256-CBC-SHA
DHE-DSS-AES256-GCM-SHA384
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES256-SHA256
DHE-DSS-AES256-SHA256
DHE-RSA-AES256-SHA
DHE-DSS-AES256-SHA
DHE-RSA-CAMELLIA256-SHA
DHE-DSS-CAMELLIA256-SHA
ECDH-RSA-AES256-GCM-SHA384
ECDH-ECDSA-AES256-GCM-SHA384
ECDH-RSA-AES256-SHA384
ECDH-ECDSA-AES256-SHA384
ECDH-RSA-AES256-SHA
ECDH-ECDSA-AES256-SHA
AES256-GCM-SHA384
AES256-SHA256
AES256-SHA
CAMELLIA256-SHA
PSK-AES256-CBC-SHA
ECDHE-RSA-DES-CBC3-SHA
ECDHE-ECDSA-DES-CBC3-SHA
SRP-DSS-3DES-EDE-CBC-SHA
SRP-RSA-3DES-EDE-CBC-SHA
SRP-3DES-EDE-CBC-SHA
EDH-RSA-DES-CBC3-SHA
EDH-DSS-DES-CBC3-SHA
ECDH-RSA-DES-CBC3-SHA
ECDH-ECDSA-DES-CBC3-SHA
DES-CBC3-SHA
PSK-3DES-EDE-CBC-SHA
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-SHA256
ECDHE-ECDSA-AES128-SHA256
ECDHE-RSA-AES128-SHA
ECDHE-ECDSA-AES128-SHA
SRP-DSS-AES-128-CBC-SHA
SRP-RSA-AES-128-CBC-SHA
SRP-AES-128-CBC-SHA
DHE-DSS-AES128-GCM-SHA256
DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES128-SHA256
DHE-DSS-AES128-SHA256
DHE-RSA-AES128-SHA
DHE-DSS-AES128-SHA
DHE-RSA-SEED-SHA
DHE-DSS-SEED-SHA
DHE-RSA-CAMELLIA128-SHA
DHE-DSS-CAMELLIA128-SHA
ECDH-RSA-AES128-GCM-SHA256
ECDH-ECDSA-AES128-GCM-SHA256
ECDH-RSA-AES128-SHA256
ECDH-ECDSA-AES128-SHA256
ECDH-RSA-AES128-SHA
ECDH-ECDSA-AES128-SHA
AES128-GCM-SHA256
AES128-SHA256
AES128-SHA
SEED-SHA
CAMELLIA128-SHA
PSK-AES128-CBC-SHA
ECDHE-RSA-RC4-SHA
ECDHE-ECDSA-RC4-SHA
ECDH-RSA-RC4-SHA
ECDH-ECDSA-RC4-SHA
RC4-SHA
RC4-MD5
PSK-RC4-SHA
EDH-RSA-DES-CBC-SHA
EDH-DSS-DES-CBC-SHA
DES-CBC-SHA
EXP-EDH-RSA-DES-CBC-SHA
EXP-EDH-DSS-DES-CBC-SHA
EXP-DES-CBC-SHA
EXP-RC2-CBC-MD5
EXP-RC4-MD5

What does openssl version show?

It sounds like you need to upgrade your SSL library, for more reasons than this alone (ie. the multiple disclosed vulnerabilities in old libraries).

  • 1
    Hey @ben nominate for Moderator elections here I feel you are deserved to. – dh47 Aug 20 '15 at 6:57

I asked Nexcess (referencing this post) and got this answer:

The page you found is actually correct. We've been seeing this a lot with the new update. What happened is that Magento updated some code to be more secure, but they made the assumption that curl would be compiled against SSL libraries that they could check with certain commands.

Unfortunately, RedHat and CentOS servers (which we use) have a cURL that was compiled against NSS, which supplies the security without some of the holes that OpenSSL was having issues with. The side effect of this is that the check Magento is doing doesn't send the right question and gets an 'unknown' response.

Commenting out the line that is mentioned at Solution to Magento Downloader 1.9.2 unknown cipher list has done the trick for everyone so far. Rumor mill is Magento will be addressing this oversight soon.

  • I have also had this problem with Nexcess (Sept 25 2015) - Still doesn't work – brentwpeterson Sep 25 '15 at 17:07
  • I checked my ticket, and I think commenting out that line worked (for me) because that's where the thread ended. Haven't tried a new install since. – Brendan Falkowski Sep 26 '15 at 18:21
  • The link doesn't seem to be working, it just redirects to here. Correct link is magento.stackexchange.com/a/73957/5209 – mbalparda Dec 4 '15 at 16:54
  • this should work but I would be concerned about it getting overwritten in an update. Have you bugged this with Magento dev team? – Eirik Dec 12 '15 at 3:09
  • I don't use the ./mage tools anymore to update Magento anymore. This was my preferred method for a long time, but it consistently fails to write all the files included with a release because of varying OS/library/permissions issues. I do the nuclear option on the filesystem every time now because this is reliable: manuals.gravitydept.com/platforms/magento/update – Brendan Falkowski Dec 14 '15 at 1:07

on our server Centos 6, NSS is up to date for this release but not the last release. other solutions commenting line, adding line are not working. the only solution which works is forcing https to false by adding line

$https = false;

before line

$uriModified = $this->getModifiedUri($uri, $https);

and commenting

$this->curlOption(CURLOPT_SSL_CIPHER_LIST, 'TLSv1');

Works for us on 1.9.2.4 Magento.

On 1.9.2.3 use the follwing on downloader/lib/Mage/HTTP/Client/Curl.php line 370 ish:

$uriModified = $this->getModifiedUri($uri, $https);
$this->_ch = curl_init();
$this->curlOption(CURLOPT_URL, $uriModified);
$this->curlOption(CURLOPT_SSL_VERIFYPEER, false);
//$this->curlOption(CURLOPT_SSL_CIPHER_LIST, 'TLSv1');
$this->curlOption(CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);
$this->getCurlMethodSettings($method, $params, $isAuthorizationRequired);

Check the commented out bits, and the new line just below it

@ben there is one more sub case in 1. Commenting the line alone may not work if curl and nss are not out of date.

If not built with openssl, curl may be built with nss (CentOS/RHEL curl). Ensure the curl and nss libraries are uptodate.

  • I agree, on older servers/services this was the case with Magento 1. It is not always practical to update a system (see cPanel servers for example) – MartyS Magemojo Support Sep 16 '16 at 18:55

protected by Marius Oct 4 '16 at 9:59

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.