Why does the site lkulgost.nalog.ru give an error?ERR_SSL_VERSION_OR_CIPHER_MISMATCH?

Introduction

On the website lkulgost.nalog.ru you can see the amount of previously paid taxes and the amount of tax to be paid by a legal entity (businessman). The single day for paying taxes for individuals is December 28 of the current year, and for organizations - until March 30 of the next year. (The dates for payment of quarterly taxes on corporate profits are April 28, July 28, October 28. Also, in the personal account of a legal entity on nalog.ru you can register a cash register machine -online cash register. Login to the website lkulgost.nalog.ru is carried out only with a certificate of the electronic signature of a legal entity, which is stored on a secure medium.

But if the workplace is not configured, an error will be displayed when opening the website https://lkulgost.nalog.ru ERR_SSL_VERSION_OR_CIPHER_MISMATCH.

Causes of error and solution

There are many official and unofficial recommendations on how to solve the problem of opening a tax website. I will give only 3 points, the most important. I give advice only for the Windows operating system, since many individual entrepreneurs and legal entities have not yet been able to switch to Linux OS...

1) In Windows, in the Control Panel in Internet Options in the client properties - check the box "Do not use outdated suits"removed.

2) In Windows on the Control Panel in the Internet Options in the client properties - the checkbox should be checkedTLS 1.2, and the top SSL checkboxes are all unchecked.

3) The site lkulgost.nalog.ru can be opened either by a browser "Yandex Browser", or "Chromium GOST", provided that:

• crypto provider installed CryptoPro latest version 5.0 R4 and its license is valid (i.e. the software product has been purchased).
• installed in the operating system Director's personal certificate, issued by the Tax Inspectorate to an individual and at the same time to an organization in which he acts as a Director on the basis of the Charter. And the Director’s private key certificate media - eToken, RuToken or Jakarta - is connected to the USB.
• installed in the operating system root certificates(in Windows, this can be done when running the application "Setting Contour Diadoc" or according to the instructions below).
• in the Yandex or Chromium GOST browser the necessary addition(plugin) "CryptoPro browser plugin" according to the instructions below.

• cookies and cache are cleared in the browser - by clicking Ctrl+Shift+Delete and selecting items to clear “Cookies and cache”.

  Link to the official instructions for setting up a workplace for access to the account of a Taxpayer - a legal entity is publicly available on the official website:

  https://www.nalog.gov.ru/html/sites/www.rn75.nalog.ru/docs/Instruct_RM_KEP.pdf

If the workplace is configured correctly, instead of an error when connecting to the tax office website, a certificate selection window appears in the web browser. In which you need to select the current Director's certificate.
Only after this will a trusted and encrypted connection using GOST algorithms be established between the client and the server and the personal account page will be opened.

When we are logged into our personal account, we can find out the TLS version in the connection properties in the address bar.

What exact version of TLS does the site lkulgost.nalog.ru use?

Answer:

TLS 1.2 with GOST R 34.11-2012 encryption

Related publications

Particular settings of the dnscrypt proxy for IPv6 usage

Launching DOH on Linux - DNS name to IP addresses resolution over HTTPS

Troubleshooting L2TP/IPsec connection errors "Could not add IPsec connection" and "no acceptable traffic selectors found"

Some amateur radio websites are not accessible on the Internet from Russia

Identifying processes that access the Internet