If an SSL handshake fails due to no cipher suite being negotiated, what is the most likely cause?

• A. Expired certificate
• B. No SSL cipher suite configured
• C. DNS misconfiguration
• D. Certificate issuer mismatch

Answer: (B)

During TLS, the client sends a list of cipher suites and the server must select one to continue the handshake. If the server has nothing to offer, there’s no cipher suite to negotiate, so the handshake cannot proceed and fails. That’s exactly what happens when no SSL cipher suite is configured: the server side (the Citrix ADC in this context) isn’t presenting any ciphers to the client.

In contrast, an expired certificate would cause a certificate validation error during the handshake, not a failure to negotiate a cipher. DNS misconfiguration would typically prevent establishing a connection at all, and a certificate issuer mismatch would trigger trust errors rather than a lack of cipher negotiation. So the failure to negotiate any cipher suite points directly to a misconfiguration where no cipher suites are configured or exposed on the SSL profile. Check the vServer/SSL profile cipher settings or cipher group on the Citrix ADC to ensure at least one cipher suite is enabled for the intended TLS versions.