# Gaia Portal cannot load showing ERR_SSL_VERSION_OR_CIPHER_MISMATCH error in the browser

## Product
All  
## Version
R75.40 (EOS), R75.40VS (EOS), R75.45 (EOS), R75.46 (EOS), R75.47 (EOS), R76 (EOS), R77 (EOS), R77.10 (EOS), R77.20 (EOS)
## OS
Gaia  
## Platform
All  
## Last Modified
2018-03-12

## Symptoms
- Vulnerability scan shows that machine running Gaia OS is vulnerable to [CVE-2013-2566](http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-2566) - SSL RC4 Cipher Suites are supported by Gaia Portal.
- Web browsers with disabled RC4 cipher are not able to connect to Gaia Portal.

Example from Google Chrome browser when connecting to Gaia Portal:

> ```
> This site can't provide a secure connection
> X.X.X.X uses an unsupported protocol.
> ERR_SSL_VERSION_OR_CIPHER_MISMATCH
> ```
> And when clicking on DETAILS:
> ```
> Unsupported protocol
> The client and server don't support a common SSL protocol version or cipher suite.
> This is likely to be caused when the server needs RC4, which is no longer considered secure.
> ```

## Cause
1. The CRIME attack requires executing attacker agent component inside the victim's web browser.

Attack may be mitigated by disabling SSL/TLS compression in the web browser or a on the web server.

All web browsers' vendors have released versions that disable SSL/TLS compression. Therefore, this vulnerability is not relevant today.

Some vulnerability scanners may report Gaia Portal to be vulnerable to [CVE-2012-4929](http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-CVE-2012-4929) / [CVE-2012-4930](http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-4930) / [CVE-2013-2566](http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-2566).
   
   However, since this attack requires a non-patched browser, and all browsers are patched today, such reports are _false positive_.

2. Web browser vendors deprecate the use of RC4 Cipher Suites based on [RFC 7465 - Prohibiting RC4 Cipher Suites](https://tools.ietf.org/html/rfc7465):

|     |     |     |
| --- | --- | --- |
| Browser | Branch / Timeline | References |
| Google Chrome | Planned to be<br>removed<br>in branch 53 | - [Chrome Issue 375342](https://bugs.chromium.org/p/chromium/issues/detail?id=375342) |
| Mozilla Firefox | Planned to be<br>removed<br>in branch 44 | - [Mozilla Security Blog - Deprecating the RC4 Cipher](https://blog.mozilla.org/security/2015/09/11/deprecating-the-rc4-cipher/) |
| Internet Explorer,<br>Microsoft Edge | Planned to be<br>disabled<br>in 2016<br> (Security Update<br>is available) | - [Knowledge Base Article 2868725](https://support.microsoft.com/en-us/kb/2868725)<br>   - [Microsoft Security Advisory 2868725](https://technet.microsoft.com/en-us/library/security/2868725)<br>   - [RC4 will no longer be supported in Microsoft Edge and IE11 [Updated]](https://blogs.windows.com/msedgedev/2016/03/16/rc4-will-no-longer-be-supported-in-microsoft-edge-and-ie11-beginning-in-april/) |

## Solution
We're here for you

Please log in / sign in to view solution

## Article Properties
Access Level: Advanced  
Status: Approved  
Date Created: 2013-07-05  
Last Modified: 2018-03-12