"tls: no cipher suite supported by both client and server" - alexa custom skill API can not make secure connection to caddy server

Whitestrake · March 15, 2021, 3:26am

Did a quick search and these appear to be the default ciphers Caddy uses:

caddyserver/caddy/blob/31fbcd74016f35c4edf89b5de9c8a519663d588b/modules/caddytls/values.go#L49-L71


      
          // defaultCipherSuites is the ordered list of all the cipher
          // suites we want to support by default, assuming AES-NI
          // (hardware acceleration for AES).
          var defaultCipherSuitesWithAESNI = []uint16{
          	tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
          	tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
          	tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
          	tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
          	tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
          	tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
          }
          
          // defaultCipherSuites is the ordered list of all the cipher
          // suites we want to support by default, assuming lack of
          // AES-NI (NO hardware acceleration for AES).
          var defaultCipherSuitesWithoutAESNI = []uint16{
          	tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
          	tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
          	tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
          	tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,

This file has been truncated. show original

The full list of supported ciphers at the time of this post is:

TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256

—tls (Caddyfile directive) — Caddy Documentation

If you can find out which ciphers Alexa’s client supports you can use the tls directive to enable it as long as it’s in that supported list, I think.

As it stands I’m not sure Caddy can give you any more detailed information, since it’s just a matter of Alexa’s client sending one cipher list, Caddy comparing it to its own cipher list, and not finding any matches.