If no cipher suite is negotiated during an SSL handshake, what is the most likely outcome?

• A. The connection is encrypted with a default cipher
• B. The handshake completes with a weak cipher
• C. The certificate is automatically renewed
• D. The handshake fails or falls back to plaintext depending on configuration

Answer: (D)

In TLS, establishing a secure channel hinges on agreeing on a cipher suite. The client advertises the suites it supports, and the server must pick one that both sides can use. If there’s no overlap and no cipher suite can be chosen, there’s nothing left to define for encryption, MAC, or key exchange, so the handshake cannot complete and the secure connection cannot be established.

That’s why the typical outcome is that the handshake fails. In some setups, however, there might be a configuration that allows a fallback to plaintext (unencrypted) traffic, but that depends on how the service or device is configured. In standard, TLS-enabled communication, no negotiated cipher means the handshake cannot proceed.