Solution to Magento Downloader 1.9.2 unknown cipher list

Question

We fixed this by commenting out line 377 in downloader/lib/Mage/HTTP/Client/Curl.php

//$this->curlOption(CURLOPT_SSL_CIPHER_LIST, 'TLSv1')

There may be a setting that lets this pass through but we did not get that far.

Answer 1

There's two things that would likely cause this.

1. You aren't using OpenSSL
2. Your OpenSSL build is out of date

---

To solve 1.

Check that you aren't using OpenSSL,

php -r "print_r(curl_version());" | grep ssl_version

If it displays anything other than OpenSSL - then that's your answer. The solution would be to remove/comment the line in question.

---

To Solve 2.

It sounds like your OpenSSL library is out of date.

Eg. A typical web server would show,

openssl ciphers | tr ':' '\n'
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-SHA384
ECDHE-ECDSA-AES256-SHA384
ECDHE-RSA-AES256-SHA
ECDHE-ECDSA-AES256-SHA
SRP-DSS-AES-256-CBC-SHA
SRP-RSA-AES-256-CBC-SHA
SRP-AES-256-CBC-SHA
DHE-DSS-AES256-GCM-SHA384
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES256-SHA256
DHE-DSS-AES256-SHA256
DHE-RSA-AES256-SHA
DHE-DSS-AES256-SHA
DHE-RSA-CAMELLIA256-SHA
DHE-DSS-CAMELLIA256-SHA
ECDH-RSA-AES256-GCM-SHA384
ECDH-ECDSA-AES256-GCM-SHA384
ECDH-RSA-AES256-SHA384
ECDH-ECDSA-AES256-SHA384
ECDH-RSA-AES256-SHA
ECDH-ECDSA-AES256-SHA
AES256-GCM-SHA384
AES256-SHA256
AES256-SHA
CAMELLIA256-SHA
PSK-AES256-CBC-SHA
ECDHE-RSA-DES-CBC3-SHA
ECDHE-ECDSA-DES-CBC3-SHA
SRP-DSS-3DES-EDE-CBC-SHA
SRP-RSA-3DES-EDE-CBC-SHA
SRP-3DES-EDE-CBC-SHA
EDH-RSA-DES-CBC3-SHA
EDH-DSS-DES-CBC3-SHA
ECDH-RSA-DES-CBC3-SHA
ECDH-ECDSA-DES-CBC3-SHA
DES-CBC3-SHA
PSK-3DES-EDE-CBC-SHA
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-SHA256
ECDHE-ECDSA-AES128-SHA256
ECDHE-RSA-AES128-SHA
ECDHE-ECDSA-AES128-SHA
SRP-DSS-AES-128-CBC-SHA
SRP-RSA-AES-128-CBC-SHA
SRP-AES-128-CBC-SHA
DHE-DSS-AES128-GCM-SHA256
DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES128-SHA256
DHE-DSS-AES128-SHA256
DHE-RSA-AES128-SHA
DHE-DSS-AES128-SHA
DHE-RSA-SEED-SHA
DHE-DSS-SEED-SHA
DHE-RSA-CAMELLIA128-SHA
DHE-DSS-CAMELLIA128-SHA
ECDH-RSA-AES128-GCM-SHA256
ECDH-ECDSA-AES128-GCM-SHA256
ECDH-RSA-AES128-SHA256
ECDH-ECDSA-AES128-SHA256
ECDH-RSA-AES128-SHA
ECDH-ECDSA-AES128-SHA
AES128-GCM-SHA256
AES128-SHA256
AES128-SHA
SEED-SHA
CAMELLIA128-SHA
PSK-AES128-CBC-SHA
ECDHE-RSA-RC4-SHA
ECDHE-ECDSA-RC4-SHA
ECDH-RSA-RC4-SHA
ECDH-ECDSA-RC4-SHA
RC4-SHA
RC4-MD5
PSK-RC4-SHA
EDH-RSA-DES-CBC-SHA
EDH-DSS-DES-CBC-SHA
DES-CBC-SHA
EXP-EDH-RSA-DES-CBC-SHA
EXP-EDH-DSS-DES-CBC-SHA
EXP-DES-CBC-SHA
EXP-RC2-CBC-MD5
EXP-RC4-MD5

What does openssl version show?

It sounds like you need to upgrade your SSL library, for more reasons than this alone (ie. the multiple disclosed vulnerabilities in old libraries).

Answer 2

I asked Nexcess (referencing this post) and got this answer:

The page you found is actually correct. We've been seeing this a lot with the new update. What happened is that Magento updated some code to be more secure, but they made the assumption that curl would be compiled against SSL libraries that they could check with certain commands.

Unfortunately, RedHat and CentOS servers (which we use) have a cURL that was compiled against NSS, which supplies the security without some of the holes that OpenSSL was having issues with. The side effect of this is that the check Magento is doing doesn't send the right question and gets an 'unknown' response.

Commenting out the line that is mentioned at Solution to Magento Downloader 1.9.2 unknown cipher list has done the trick for everyone so far. Rumor mill is Magento will be addressing this oversight soon.

Answer 3

on our server Centos 6, NSS is up to date for this release but not the last release. other solutions commenting line, adding line are not working. the only solution which works is forcing https to false by adding line

$https = false;

before line

$uriModified = $this->getModifiedUri($uri, $https);

and commenting

$this->curlOption(CURLOPT_SSL_CIPHER_LIST, 'TLSv1');

Works for us on 1.9.2.4 Magento.

Answer 4

On 1.9.2.3 use the follwing on downloader/lib/Mage/HTTP/Client/Curl.php line 370 ish:

$uriModified = $this->getModifiedUri($uri, $https);
$this->_ch = curl_init();
$this->curlOption(CURLOPT_URL, $uriModified);
$this->curlOption(CURLOPT_SSL_VERIFYPEER, false);
//$this->curlOption(CURLOPT_SSL_CIPHER_LIST, 'TLSv1');
$this->curlOption(CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);
$this->getCurlMethodSettings($method, $params, $isAuthorizationRequired);

Check the commented out bits, and the new line just below it

Answer 5

@ben there is one more sub case in 1. Commenting the line alone may not work if curl and nss are not out of date.

If not built with openssl, curl may be built with nss (CentOS/RHEL curl). Ensure the curl and nss libraries are uptodate.