SSL routines:tls_setup_handshake:no protocols available

The openssl CLI (3.0 and 3.5) prints "error:0A0000BF:SSL routines:tls_setup_handshake:no protocols available"; applications that format errors without the function name show "error:0A0000BF:SSL routines::no protocols available".

OpenSSL (client or server side) — SSL_R_NO_PROTOCOLS_AVAILABLE before the handshake starts

What it means

OpenSSL refused to even start the handshake because, after applying all restrictions, no protocol version is left to offer. Typically the application asked for TLS 1.0 or 1.1 while OpenSSL's security level (2 by default on current distributions) forbids them, or the configured minimum version is above the maximum. Nothing was sent to the server.

Why it happens

• TLS 1.0/1.1 forced while the security level forbids them

  common

  Since OpenSSL 3.0, security level 1 and above disable TLS 1.0 and 1.1; distributions default to level 2. A client hard-coded to TLS 1.0 for a legacy device therefore has nothing to offer.

• Minimum version above the maximum

  occasional

  Configurations that combine a minimum of TLS 1.3 with a maximum of TLS 1.2 (often from two different settings layered on each other) leave an empty range.

• A system-wide crypto policy overrides the application

  occasional

  RHEL and Fedora crypto policies (DEFAULT, FUTURE) and Debian's openssl.cnf set MinProtocol and the security level for every OpenSSL application on the machine.

How to fix it

1. 1.

   Find the restricting setting

   Look at openssl.cnf and the system crypto policy for MinProtocol, MaxProtocol and CipherString @SECLEVEL values.

   openssl version -d                                  # where openssl.cnf lives
   grep -nE 'MinProtocol|MaxProtocol|CipherString' /usr/lib/ssl/openssl.cnf /etc/ssl/openssl.cnf 2>/dev/null
   update-crypto-policies --show 2>/dev/null           # RHEL/Fedora system policy

2. 2.

   Legacy device: lower the level for one command

   Adding @SECLEVEL=0 to the cipher string re-enables TLS 1.0/1.1 for that invocation only. Keep such exceptions out of system-wide configuration and off untrusted networks.

   # For a one-off test against a legacy device: lower the security level for this command only
   echo | openssl s_client -connect legacy.example.com:443 -tls1 -cipher 'DEFAULT:@SECLEVEL=0'

3. 3.

   Use a consistent version range

   Make sure the minimum does not exceed the maximum; TLS 1.2 to TLS 1.3 is the usual range today.

   # openssl.cnf (system_default_sect): a consistent range
   MinProtocol = TLSv1.2
   MaxProtocol = TLSv1.3

← Browse the full signature error database