We fixed this by commenting out line 377 in
There may be a setting that lets this pass through but we did not get that far.
There's two things that would likely cause this.
Check that you aren't using OpenSSL,
php -r "print_r(curl_version());" | grep ssl_version
If it displays anything other than OpenSSL - then that's your answer. The solution would be to remove/comment the line in question.
It sounds like your OpenSSL library is out of date.
Eg. A typical web server would show,
openssl ciphers | tr ':' '\n' ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-ECDSA-AES256-SHA SRP-DSS-AES-256-CBC-SHA SRP-RSA-AES-256-CBC-SHA SRP-AES-256-CBC-SHA DHE-DSS-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-SHA256 DHE-DSS-AES256-SHA256 DHE-RSA-AES256-SHA DHE-DSS-AES256-SHA DHE-RSA-CAMELLIA256-SHA DHE-DSS-CAMELLIA256-SHA ECDH-RSA-AES256-GCM-SHA384 ECDH-ECDSA-AES256-GCM-SHA384 ECDH-RSA-AES256-SHA384 ECDH-ECDSA-AES256-SHA384 ECDH-RSA-AES256-SHA ECDH-ECDSA-AES256-SHA AES256-GCM-SHA384 AES256-SHA256 AES256-SHA CAMELLIA256-SHA PSK-AES256-CBC-SHA ECDHE-RSA-DES-CBC3-SHA ECDHE-ECDSA-DES-CBC3-SHA SRP-DSS-3DES-EDE-CBC-SHA SRP-RSA-3DES-EDE-CBC-SHA SRP-3DES-EDE-CBC-SHA EDH-RSA-DES-CBC3-SHA EDH-DSS-DES-CBC3-SHA ECDH-RSA-DES-CBC3-SHA ECDH-ECDSA-DES-CBC3-SHA DES-CBC3-SHA PSK-3DES-EDE-CBC-SHA ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ECDSA-AES128-SHA SRP-DSS-AES-128-CBC-SHA SRP-RSA-AES-128-CBC-SHA SRP-AES-128-CBC-SHA DHE-DSS-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-SHA256 DHE-DSS-AES128-SHA256 DHE-RSA-AES128-SHA DHE-DSS-AES128-SHA DHE-RSA-SEED-SHA DHE-DSS-SEED-SHA DHE-RSA-CAMELLIA128-SHA DHE-DSS-CAMELLIA128-SHA ECDH-RSA-AES128-GCM-SHA256 ECDH-ECDSA-AES128-GCM-SHA256 ECDH-RSA-AES128-SHA256 ECDH-ECDSA-AES128-SHA256 ECDH-RSA-AES128-SHA ECDH-ECDSA-AES128-SHA AES128-GCM-SHA256 AES128-SHA256 AES128-SHA SEED-SHA CAMELLIA128-SHA PSK-AES128-CBC-SHA ECDHE-RSA-RC4-SHA ECDHE-ECDSA-RC4-SHA ECDH-RSA-RC4-SHA ECDH-ECDSA-RC4-SHA RC4-SHA RC4-MD5 PSK-RC4-SHA EDH-RSA-DES-CBC-SHA EDH-DSS-DES-CBC-SHA DES-CBC-SHA EXP-EDH-RSA-DES-CBC-SHA EXP-EDH-DSS-DES-CBC-SHA EXP-DES-CBC-SHA EXP-RC2-CBC-MD5 EXP-RC4-MD5
openssl version show?
It sounds like you need to upgrade your SSL library, for more reasons than this alone (ie. the multiple disclosed vulnerabilities in old libraries).
I asked Nexcess (referencing this post) and got this answer:
The page you found is actually correct. We've been seeing this a lot with the new update. What happened is that Magento updated some code to be more secure, but they made the assumption that curl would be compiled against SSL libraries that they could check with certain commands.
Unfortunately, RedHat and CentOS servers (which we use) have a cURL that was compiled against NSS, which supplies the security without some of the holes that OpenSSL was having issues with. The side effect of this is that the check Magento is doing doesn't send the right question and gets an 'unknown' response.
Commenting out the line that is mentioned at Solution to Magento Downloader 1.9.2 unknown cipher list has done the trick for everyone so far. Rumor mill is Magento will be addressing this oversight soon.
on our server Centos 6, NSS is up to date for this release but not the last release. other solutions commenting line, adding line are not working. the only solution which works is forcing https to false by adding line
$https = false;
$uriModified = $this->getModifiedUri($uri, $https);
Works for us on 18.104.22.168 Magento.
On 22.214.171.124 use the follwing on downloader/lib/Mage/HTTP/Client/Curl.php line 370 ish:
$uriModified = $this->getModifiedUri($uri, $https); $this->_ch = curl_init(); $this->curlOption(CURLOPT_URL, $uriModified); $this->curlOption(CURLOPT_SSL_VERIFYPEER, false); //$this->curlOption(CURLOPT_SSL_CIPHER_LIST, 'TLSv1'); $this->curlOption(CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1); $this->getCurlMethodSettings($method, $params, $isAuthorizationRequired);
Check the commented out bits, and the new line just below it
@ben there is one more sub case in 1. Commenting the line alone may not work if curl and nss are not out of date.
If not built with openssl, curl may be built with nss (CentOS/RHEL curl). Ensure the curl and nss libraries are uptodate.