SSLHandshakeException: no cipher suites in common

javax.net.ssl.SSLHandshakeException: no cipher suites in common

This has two causes:

1. The server doesn't have a private key and certificate, and possibly doesn't have a keystore at all. In such a case it can only use the insecure anonymous cipher suites, which are disabled by default, and should stay that way. So there is no cipher suite that it can agree to use with the client.

2. Excessive restrictions on cipher suites imposed by client or server or both such that there can be no agreement.

Re your keystores and truststores, that all looks OK except that you are doing four import steps where you only need two. You don't need to import the server's certificate into the server's own truststore, or the client's certificate into the client's truststore. You only need this:

Server:

$ keytool -import -v -trustcacerts -alias clientkey -file ../client/client.cer -keystore cacerts.jks -keypass p@ssw0rd -storepass p@ssw0rd

Client:

$ keytool -import -v -trustcacerts -alias serverkey -file ../server/server.cer -keystore cacerts.jks -keypass changeit -storepass changeit

and you only need it because you're using a self-signed certificate. Simple solution: don't. Use a CA-signed certificate, which is trusted by the default truststore shipped with Java.

I got this error when setting up SSL on a Cassandra cluster. The problem turned out to be in the documentation of version 2.0 when describing generating the keys:

keytool -genkey -alias -keystore .keystore

It omits the specification of RSA as the algorithm, should be (see v1.2 docs):

keytool -genkey -alias -keyalg RSA -keystore .keystore