# Strange cipher issue

**URL:** <https://discourse.haproxy.org/t/strange-cipher-issue/6488>\
**Category:** Help!\
**Created:** [April 17, 2021, 3:26pm UTC](https://discourse.haproxy.org/t/strange-cipher-issue/6488 "2021-04-17T15:26:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tridevk](https://avatars.discourse-cdn.com/v4/letter/t/db5fbb/32.png) [@tridevk](https://discourse.haproxy.org/u/tridevk)\
**Post date:** [April 17, 2021, 3:26pm UTC](https://discourse.haproxy.org/t/strange-cipher-issue/6488/1 "2021-04-17T15:26:49Z")

</div>

Hi ,  
I am struggling with a cipher issue and would request your input.  
The haproxy is built with opensssl.I am trying to use “ssl-default-bind-ciphersuites” is global section. But haproxy compalns as

**“unknown keyword ‘ssl-default-bind-ciphersuites’ in ‘global’ section”**

where as it does not complain about **“ssl-default-bind-options”**.

Would appreciate much if you can guide me, on what I am doing wrong..

Following is my global and default section in my haproxy.cfg.

global  
ssl-default-bind-options ssl-min-ver TLSv1.2  
**ssl-default-bind-ciphersuites TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384**  
log stdout format raw local0 debug  
tune.ssl.default-dh-param 2048  
user otn  
group otn  
tune.http.maxhdr 32767

# tune.maxrewrite 1024

```
    tune.bufsize 163840
    master-worker

```

defaults  
mode http  
log global  
option http-server-close  
option httplog  
option dontlognull  
option redispatch  
option forwardfor  
retries 3  
backlog 4096  
timeout client 30m  
timeout connect 1m  
timeout server 30m  
timeout tunnel 30m  
timeout http-request 60m  
timeout queue 10s  
maxconn 10000  
option accept-invalid-http-response  
default-server inter 3s rise 2 fall 3 init-addr last,libc,none

**haproxy -vv**

HA-Proxy version 2.0.14 2020/04/02 - [https://haproxy.org/](https://haproxy.org/)  
Build options :  
TARGET = linux-glibc  
CPU = generic  
CC = gcc  
CFLAGS = -O2 -g -fno-strict-aliasing -Wdeclaration-after-statement -fwrapv -Wno-unused-label -Wno-sign-compare -Wno-unused-parameter -Wno-old-style-declaration -Wno-ignored-qualifiers -Wno-clobbered -Wno-missing-field-initializers -Wtype-limits  
OPTIONS = USE\_PCRE=1 USE\_OPENSSL=1 USE\_LUA=1 USE\_ZLIB=1 USE\_SYSTEMD=1

Feature list : +EPOLL -KQUEUE -MY\_EPOLL -MY\_SPLICE +NETFILTER +PCRE -PCRE\_JIT -PCRE2 -PCRE2\_JIT +POLL -PRIVATE\_CACHE +THREAD -PTHREAD\_PSHARED -REGPARM -STATIC\_PCRE -STATIC\_PCRE2 +TPROXY +LINUX\_TPROXY +LINUX\_SPLICE +LIBCRYPT +CRYPT\_H -VSYSCALL +GETADDRINFO +OPENSSL +LUA +FUTEX +ACCEPT4 -MY\_ACCEPT4 +ZLIB -SLZ +CPU\_AFFINITY +TFO +NS +DL +RT -DEVICEATLAS -51DEGREES -WURFL +SYSTEMD -OBSOLETE\_LINKER +PRCTL +THREAD\_DUMP -EVPORTS

Default settings :  
bufsize = 16384, maxrewrite = 1024, maxpollevents = 200

Built with multi-threading support (MAX\_THREADS=64, default=12).  
**Built with OpenSSL version : OpenSSL 1.0.2k-fips 26 Jan 2017**  
**Running on OpenSSL version : OpenSSL 1.0.2k-fips 26 Jan 2017**  
**OpenSSL library supports TLS extensions : yes**  
**OpenSSL library supports SNI : yes**  
**OpenSSL library supports : SSLv3 TLSv1.0 TLSv1.1 TLSv1.2**  
Built with Lua version : Lua 5.3.5  
Built with network namespace support.  
Built with transparent proxy support using: IP\_TRANSPARENT IPV6\_TRANSPARENT IP\_FREEBIND  
Built with zlib version : 1.2.7  
Running on zlib version : 1.2.7  
Compression algorithms supported : identity(“identity”), deflate(“deflate”), raw-deflate(“deflate”), gzip(“gzip”)  
Built with PCRE version : 8.32 2012-11-30  
Running on PCRE version : 8.32 2012-11-30  
PCRE library supports JIT : no (USE\_PCRE\_JIT not set)  
Encrypted password support via crypt(3): yes

Available polling systems :  
epoll : pref=300, test result OK  
poll : pref=200, test result OK  
select : pref=150, test result OK  
Total: 3 (3 usable), will use epoll.

Available multiplexer protocols :  
(protocols marked as cannot be specified using ‘proto’ keyword)  
h2 : mode=HTX side=FE|BE mux=H2  
h2 : mode=HTTP side=FE mux=H2  
 : mode=HTX side=FE|BE mux=H1  
 : mode=TCP|HTTP side=FE|BE mux=PASS

Available services : none

Available filters :  
[SPOE] spoe  
[COMP] compression  
[CACHE] cache  
[TRACE] trace

thanks a lot.  
Tridev

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [April 18, 2021, 9:57am UTC](https://discourse.haproxy.org/t/strange-cipher-issue/6488/2 "2021-04-18T09:57:55Z")

</div>

`ssl-default-bind-ciphersuites` is for TLSv1.3 only and requires OpenSSL 1.1.1, just as the documentation says:

> This setting is only available when support for OpenSSL was built in and OpenSSL 1.1.1 or later was used to build HAProxy. It sets the default string describing the list of cipher algorithms (“cipher suite”) that are negotiated during the TLSv1.3 handshake for all “[bind](https://cbonte.github.io/haproxy-dconv/2.0/configuration.html#)” lines which do not explicitly define theirs.

Maybe you want `ssl-default-bind-ciphers` instead?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [April 18, 2021, 10:00am UTC](https://discourse.haproxy.org/t/strange-cipher-issue/6488/3 "2021-04-18T10:00:25Z")

</div>

Another thing:

`TLS_DHE_RSA_WITH_AES_256_GCM_SHA384` is a =\< TLSv1.2 cipher, it’s also the [IANA name, not the Openssl name](https://ciphersuite.info/cs/TLS_DHE_RSA_WITH_AES_256_GCM_SHA384/), so this needs to be a) `ssl-default-bind-ciphers` and b) `DHE-RSA-AES256-GCM-SHA384` :

```
ssl-default-bind-ciphers DHE-RSA-AES256-GCM-SHA384
```

---

<div class="post-metadata">

**Author:** ![cindyforcia](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/cindyforcia/32/1442_2.png) [@cindyforcia](https://discourse.haproxy.org/u/cindyforcia)\
**Post date:** [April 22, 2021, 7:11am UTC](https://discourse.haproxy.org/t/strange-cipher-issue/6488/4 "2021-04-22T07:11:33Z")

</div>

@tridevk So kind of you for this post. Actually i was facing same problem i tried my best but all in wane. Then i saw your post it gave my error solution. Thanks for sharing the solution of this error. 🙂

---

<div class="post-metadata">

**Author:** ![tridevk](https://avatars.discourse-cdn.com/v4/letter/t/db5fbb/32.png) [@tridevk](https://discourse.haproxy.org/u/tridevk)\
**Post date:** [April 29, 2021, 12:35pm UTC](https://discourse.haproxy.org/t/strange-cipher-issue/6488/5 "2021-04-29T12:35:06Z")

</div>

My Apologies for not coming back earlier.  
Thank you @lukastribus for pointing out the ssl version and suggestion to ssl-default-bind-ciphers.

it worked brilliantly.  
Thank you again.