title: How to fix curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s)
body: <p>I am trying to access and download some <code>.torrent</code> files from <code>https://torrage.com</code> using <code>php curl</code>.
  But nothing happens , <code>curl_error($ch)</code> gives</p>
  
  <pre><code>$ch = curl_init ('https://torrage.com/torrent/640FE84C613C17F663551D218689A64E8AEBEABE.torrent');
  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
  curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0');
  curl_setopt($ch, CURLOPT_HEADER, 1);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
  curl_setopt($ch, CURLOPT_VERBOSE,true);
  $data = curl_exec($ch);
  $error = curl_error($ch);
  curl_close ($ch);
  echo $error;
  </code></pre>
  
  <p>this gives.</p>
  
  <pre><code>Cannot communicate securely with peer: no common encryption algorithm(s).
  </code></pre>
  
  <p>If I try from shell like this</p>
  
  <pre><code>[root@prod1 yum.repos.d]# curl -I https://torrage.com
  curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s).
  </code></pre>
  
  <p>in verbose mode</p>
  
  <pre><code>[root@prod1 yum.repos.d]# curl -v https://torrage.com
  * Rebuilt URL to: https://torrage.com/
  *   Trying 81.17.30.48...
  * Connected to torrage.com (81.17.30.48) port 443 (#0)
  * Initializing NSS with certpath: sql:/etc/pki/nssdb
  *   CAfile: /etc/pki/tls/certs/ca-bundle.crt
    CApath: none
  * NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP)
  * Cannot communicate securely with peer: no common encryption algorithm(s).
  * Closing connection 0
  curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s).
  </code></pre>
  
  <p>system info <strong>centos 7. x86_64</strong></p>
  
  <pre><code>[root@prod1 yum.repos.d]# uname -a
  Linux prod1.localdomain 3.10.0-229.4.2.el7.x86_64 #1 SMP Wed May 13 10:06:09 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
  </code></pre>
  
  <p><strong>curl version</strong></p>
  
  <pre><code>[root@prod1 yum.repos.d]# curl -V
  curl 7.29.0 (x86_64-redhat-linux-gnu)
  </code></pre>
  
  <p><strong>openssl , already patched.</strong></p>
  
  <pre><code>[root@prod1 yum.repos.d]# openssl version -a
  OpenSSL 1.0.1e-fips 11 Feb 2013
  built on: Mon Jun 15 18:39:20 UTC 2015
  platform: linux-x86_64
  options:  bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx)
  compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -DTERMIO -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
  OPENSSLDIR: "/etc/pki/tls"
  engines:  dynamic
  </code></pre>
  
  <p><strong>verifying openssl patched or not.</strong></p>
  
  <pre><code>[root@prod1 yum.repos.d]# rpm -q --changelog openssl | grep CVE-2014-0224
  - fix CVE-2014-0224 fix that broke EAP-FAST session resumption support
  - fix CVE-2014-0224 - SSL/TLS MITM vulnerability
  </code></pre>
  
  <hr>
  
  <p><strong>What i have tried :</strong></p>
  
  <p><strong>1) i have tried using HTTP insted of HTTPS, but the site forces to use HTTPS.
  e.g.</strong></p>
  
  <pre><code>[root@prod1 yum.repos.d]# curl -I http://torrage.com
  HTTP/1.1 301 Moved Permanently
  Server: nginx/1.9.0
  Date: Mon, 29 Jun 2015 04:13:17 GMT
  Content-Type: text/html
  Content-Length: 184
  Connection: keep-alive
  Location: https://torrage.com/
  </code></pre>
  
  <p><strong>2) updating ca-bundle.crt</strong> </p>
  
  <pre><code>cp /etc/pki/tls/certs/ca-bundle.crt /root/backup/
  curl http://curl.haxx.se/ca/cacert.pem -o /etc/pki/tls/certs/ca-bundle.crt
  </code></pre>
  
  <p><strong>3) Updating Curl to latest version 7.43.0</strong></p>
  
  <pre><code>nano /etc/yum.repos.d/city-fan-for-curl.repo
  </code></pre>
  
  <p>with this repo.</p>
  
  <pre><code>[CityFanforCurl]
  name=City Fan Repo
  baseurl=http://www.city-fan.org/ftp/contrib/yum-repo/rhel7/x86_64/
  enabled=0
  gpgcheck=0
  </code></pre>
  
  <p>and then doing</p>
  
  <pre><code>yum update curl --enablerepo=CityFanforCurl
  </code></pre>
  
  <p>then verifying curl version</p>
  
  <pre><code>[root@prod1 yum.repos.d]# curl -V
  curl 7.43.0 (x86_64-redhat-linux-gnu) libcurl/7.43.0 NSS/3.18 Basic ECC zlib/1.2.7 libidn/1.28 libssh2/1.6.0
  Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
  Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz UnixSockets Metalink
  </code></pre>
  
  <p><strong>4) i have tried this to check whether my curl is outdated or not.</strong></p>
  
  <p>reference: <a href="https://unix.stackexchange.com/questions/162816/disable-sslv3-in-curl">https://unix.stackexchange.com/questions/162816/disable-sslv3-in-curl</a></p>
  
  <pre><code>[root@prod1 yum.repos.d]# curl -1IsS --ciphers ecdhe_ecdsa_aes_128_sha https://sslspdy.com
  HTTP/1.1 200 OK
  Server: nginx centminmod
  Content-Type: text/html; charset=utf-8
  Connection: close
  Vary: Accept-Encoding
  Strict-Transport-Security: max-age=31536000; includeSubdomains
  Date: Mon, 12 Jan 1970 23:00:11 GMT
  X-Page-Speed: ngx_pagespeed
  Cache-Control: max-age=0, no-cache
  </code></pre>
  
  <hr>
  
  <p>How can i fix the issue ? and download files from Torrage.com using <code>PHP Curl</code> ?</p>
  
  <p>*I cant use file_get_contents as i am using <code>curl_multi</code> for simultaneous downloads.</p>
  
  <hr>
  
  <p>Update 1:</p>
  
  <p>As suggested by <strong>steffen-ullrich</strong> </p>
  
  <pre><code>[root@prod1 randoadmin]# curl --ciphers ecdhe_rsa_aes_128_gcm_sha_256 -I https://torrage.com
  HTTP/1.1 200 OK
  Server: nginx/1.9.0
  Date: Mon, 29 Jun 2015 05:54:17 GMT
  Content-Type: text/html; charset=UTF-8
  Connection: keep-alive
  Expires: Mon, 26 Jul 1997 05:00:00 GMT
  Last-Modified: Mon, 29 Jun 2015 05:50:40 GMT
  Cache-Control: no-store, no-cache, must-revalidate
  Cache-Control: post-check=0, pre-check=0
  Pragma: no-cache
  Vary: Accept-Encoding, Accept-Encoding
  Strict-Transport-Security: max-age=31536000
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  </code></pre>
  
  <p>but thats with shell how can i implement it with <code>PHP-curl</code> ?</p>
  
  <p>Update 2:</p>
  
  <p>i have modified code and defined cipher to use while using curl like this.</p>
  
  <pre><code>$ch = curl_init ('https://torrage.com/torrent/640FE84C613C17F663551D218689A64E8AEBEABE.torrent');
  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
  curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0');
  curl_setopt($ch, CURLOPT_HEADER, 1);
  curl_setopt($ch, CURLOPT_SSL_CIPHER_LIST, 'ecdhe_rsa_aes_128_gcm_sha_256');
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
  curl_setopt($ch, CURLOPT_VERBOSE,true);
  $data = curl_exec($ch);
  $error = curl_error($ch);
  curl_close ($ch);
  echo $error;
  echo $data ;
  </code></pre>
  
  <p>Its working great. Issue solved many thanks to <strong>steffen-ullrich</strong> .</p>