Firefox Secure Connection Failed


If you open a website that uses an deprecated TLS encryption, you may get the Firefox error page “Secure Connection Failed”.

An error occurred during a connection to [host] Cannot communicate securely with peer: no common encryption algorithm(s).

Secure Connection Failed with Firefox


The story behind

Sometimes administrators have to be able to access devices that are operated with older operating systems they uses deprecated TLS versions, this can be network devices, servers and routers for which updates are no longer available, but are still required in a transitional period. Nevertheless older equipment usually still works fine, have they reached the status end of live and should be replaced in the near future.

TLS 1.0 and TLS 1.1 have been deprecated since Firefox 78 Release and should not be used nowadays.

Firefox supports the deprecated protocols (if you absolutely need it) via “security.tls.version.enable-deprecated” in about:config . This should only be enabled temporarily to access your device.

How to enable TLS 1.0 and TLS 1.1 in Firefox

Open Firefox and hitabout:configin the search bar and press Enter. In the caution screen, select “Accept the Risk and Continue”.

Firefox about:config

Now search for security.tls.version.enable-deprecated and set it to true at the switch on the right.

security.tls.version.enable-deprecated = true

Next search for security.ssl3.dhe_rsa_aes_128_sha and set it to true, do the same for security.ssl3.dhe_rsa_aes_256_sha.

Last search for security.tls.version.min in the search bar above and set it to “1” then click save on the right. After a Firefox restart, the connection using weak encryption is established.

  In the Warning screen, Potential Security Risk Ahead, select “Advanced” and choose “Accept the Risk and Continue”.

weak encrypted connection to iLO - Lights-Out-Management.
In this result an weak encrypted connection to an older iLO – Lights-Out-Management.

The values for the TLS security.tls.version.min and security.tls.version.max preferences mean:

1 = TLS 1.0
2 = TLS 1.1
3 = TLS 1.2
4 = TLS 1.3

no success yet! the next hint might help

Search for security.ssl.enable_ocsp_stapling in the search bar and set it to false, then restart Firefox and try again.

  OCSP is a method to check whether a site’s SSL certificate has been revoked by its issuer. “Stapling” is a method for the site to deliver proof of validity along with its own certificate. This improves privacy for the user because you don’t need to reveal to a third party (the issuer) that you need to know about the site you’re trying to use.

How useful was this post?

Click on a star to rate it!

Average rating / 5. Vote count:

No votes so far! Be the first to rate this post.

We are sorry that this post was not useful for you!

Let us improve this post!

Tell us how we can improve this post?

Leave a Reply

Your email address will not be published. Required fields are marked *