Firefox Secure Connection Failed: Error Codes and Fixes

Secure Connection Failed is Firefox's page for a TLS handshake that could not be completed. It reads "An error occurred during a connection to example.com," followed by a code such as SSL_ERROR_NO_CYPHER_OVERLAP or PR_END_OF_FILE_ERROR, and the note "The page you are trying to view cannot be shown because the authenticity of the received data could not be verified."

The code on the page matters more than the headline. This page maps the common ones to a cause and a first action. For the certificate-warning variant (the page titled "Warning: Potential Security Risk Ahead") see SSL_ERROR_BAD_CERT_DOMAIN and Your connection is not private.

Match your code

Firefox's wording changes between versions, so match the code literally rather than the sentence.

If you are a visitor

1. Check the date and time on your device. Wrong clocks cause many certificate and handshake failures.
2. Check the URL. https:// on a port that serves plain HTTP gives SSL_ERROR_RX_RECORD_TOO_LONG. Try http:// only if you trust the site and it is not sensitive.
3. Turn off VPN, proxy or antivirus HTTPS scanning. Products that intercept TLS often present certificates Firefox does not trust, because Firefox uses its own certificate store.
4. Test in a Private Window with add-ons disabled, or restart in Troubleshoot Mode from the Help menu.
5. Update Firefox. Old versions may lack modern ciphers.
6. Try another network. If the page loads elsewhere, the original network or DNS filter is interfering.
7. Report to the site owner with the exact code, because they can fix server settings you cannot.

If you own the site

1. Test the handshake from outside

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>&1 | grep -E "Protocol|Cipher|Verify|alert|error"
curl -vI https://example.com/ 2>&1 | grep -E "SSL|TLS|error"

The TLS Version Checker tests each protocol version and the SSL Checker validates the certificate and chain. Use the SSL Chain Debugger when SEC_ERROR_UNKNOWN_ISSUER suggests a missing intermediate.

2. Protocols and ciphers

Serve TLS 1.2 and TLS 1.3, and use a maintained cipher list from a generator such as Mozilla's SSL configuration guide. A legacy config with only old ciphers produces NO_CYPHER_OVERLAP. See cipher suite and ERR_SSL_VERSION_OR_CIPHER_MISMATCH.

3. No TLS listener on the port

sudo ss -ltnp | grep ':443'

Confirm a process is listening on 443 with TLS enabled. In nginx you need listen 443 ssl;. The Port Checker shows whether the port is reachable.

4. SNI and virtual hosts

If the server has several sites on one IP and the request lacks a matching server name, it may close the connection or serve a default certificate. See SNI. Test with and without -servername to see the difference.

5. Certificate chain and trust

Firefox trusts its own root store, so a missing intermediate on the server shows as an unknown issuer even if other tools cope. Serve the full chain. See incomplete certificate chain.

6. HSTS and bad configurations

Sites that sent HSTS earlier prevent users from bypassing errors. Check with the HSTS Checker before changing HTTPS behavior; see HSTS preload guide.

7. Firewalls and rate limiters

A firewall or bot filter dropping TLS from certain addresses yields PR_END_OF_FILE_ERROR or PR_CONNECT_RESET_ERROR for those users only. Check logs for blocks that match their IPs. Also check the nameserver answer with the DNS Checker when the hostname points somewhere unexpected.

Next steps

• Read SSL and TLS certificate errors explained.
• See Chrome's equivalent ERR_SSL_PROTOCOL_ERROR.
• Look at the OpenSSL-side view in SSL wrong version number.
• Renew certificates reliably: Let's Encrypt renewal failures.

FAQ

Why does Firefox show this when Chrome does not?

Firefox uses its own certificate store and applies its own TLS policy, so missing intermediates and older protocol settings can fail there first.

Can I click through Secure Connection Failed?

No. Unlike certificate warnings, there is usually no "Accept the Risk" button, because the handshake never completed.

Does it mean the site was hacked?

Not usually. It points to a configuration, network or interception problem during the handshake.

What if the code is not in your table?

Search the exact code, then test with openssl and the TLS Version Checker to see what the server really offers.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.