ERR_SSL_VERSION_OR_CIPHER_MISMATCH: Fix TLS Protocol and Cipher Errors

ERR_SSL_VERSION_OR_CIPHER_MISMATCH is shown by Chrome and Edge as "This site can't provide a secure connection" with the line "uses an unsupported protocol." During the TLS handshake the browser and server must agree on a protocol version and a cipher suite. This error means there was no overlap. Firefox shows SSL_ERROR_NO_CYPHER_OVERLAP or SSL_ERROR_UNSUPPORTED_VERSION (sometimes "PR_END_OF_FILE_ERROR"), and Safari says it cannot establish a secure connection.

Modern browsers dropped TLS 1.0 and 1.1 in 2020, and they refuse obsolete ciphers such as RC4 and 3DES, so a server that has not been updated in years commonly triggers it. The opposite can also happen: a legacy client that supports only old protocols cannot talk to a hardened modern server.

Diagnose which side is the problem

# Which protocols does the server accept?
for v in tls1 tls1_1 tls1_2 tls1_3; do
  printf "%s: " $v
  echo | openssl s_client -connect example.com:443 -servername example.com -$v 2>&1 \
    | grep -E "Protocol  :|handshake failure|no protocols|alert" | head -1
  echo
done

Some OpenSSL builds disable tls1 and tls1_1 locally, so a failure there may be your client, not the server. For ciphers, scan with nmap:

nmap --script ssl-enum-ciphers -p 443 example.com

The TLS वर्शन चेकर reports supported versions from outside your network without installing anything.

If you are a visitor

1. Confirm the date and time on your device.
2. Update your browser and operating system. Very old systems (for example Windows XP or old Android versions) lack TLS 1.2 or modern cipher suites. If your device cannot update, use another one.
3. Check Internet Options on Windows. In Advanced settings, make sure TLS 1.2 and 1.3 are enabled for apps that use the system settings.
4. Pause antivirus HTTPS scanning, since old scanning engines may negotiate poor ciphers.
5. Try a different browser. If it works elsewhere, the first browser has an outdated or restricted configuration (check enterprise policies at chrome://policy).
6. Do not try to re-enable TLS 1.0/1.1 in browser flags; those options were removed, and downgrading is unsafe.
7. Tell the site owner. If the site only offers outdated protocols, only they can fix it.

If you own the site

1. The server only supports old TLS versions

If your web server, OpenSSL library or load balancer is outdated, it may offer only TLS 1.0 or 1.1, or SSLv3. Upgrade the software. Then set explicit modern protocols.

nginx:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;

Apache:

SSLProtocol -all +TLSv1.2 +TLSv1.3

TLS 1.3 requires OpenSSL 1.1.1 or later. Reload (nginx -t && systemctl reload nginx, or apachectl graceful) and re-test.

2. Cipher suites are too restrictive or too old

Hand-edited ssl_ciphers lines copied from old tutorials can leave no suite that browsers accept. For TLS 1.2, a conservative modern list is:

ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;

TLS 1.3 suites are configured separately and generally need no tuning. Generate a profile for your server version with Mozilla's SSL configuration generator rather than copying forum posts.

3. Certificate key type does not match the ciphers

If you serve only an ECDSA certificate but your cipher list contains only RSA suites (or the reverse), no cipher is usable. Match the suites to the key type, or serve both certificates.

4. HTTP/2 requirements

Browsers require TLS 1.2 or later with suitable ciphers for HTTP/2. Servers with http2 enabled but a blacklisted cipher selection can fail negotiation. Check with the HTTP/2 and HTTP/3 Checker and read ERR_HTTP2_PROTOCOL_ERROR if the failure happens later.

5. A CDN or load balancer terminates TLS with a restrictive policy

Managed load balancers have named security policies. A policy requiring TLS 1.3 only, or one frozen on legacy suites, will reject clients without overlap. Review the policy in your provider's console and choose a current recommended one. Check your provider's current documentation, since defaults change.

6. Wrong port or protocol

Pointing HTTPS at a port that speaks a different protocol (a mail or database port) yields a mismatch-style error. Confirm the right port with the पोर्ट चेकर. If the handshake yields garbage rather than a protocol alert, see ERR_SSL_PROTOCOL_ERROR.

7. Legacy clients you must support

If a payment terminal or embedded device needs TLS 1.0 or 1.1, put a separate endpoint or hostname in front for it, and keep it isolated from the main site. Do not weaken the public site's configuration for it.

Confirm the fix

1. Run the TLS वर्शन चेकर; it should list TLS 1.2 and/or 1.3.
2. Verify the certificate with the SSL Checker and the chain with the SSL Chain Debugger.
3. Run openssl s_client -tls1_2 and -tls1_3 to confirm both handshakes work.
4. Add an uptime monitor so protocol regressions after upgrades are caught.

अगले कदम

• Review SSL/TLS certificate errors explained.
• See HSTS preload before enforcing strict HTTPS everywhere.
• Learn about security headers.
• If a Firefox user sees a different message, read SEC_ERROR_EXPIRED_CERTIFICATE.

सामान्य प्रश्न

Which TLS versions should I support?

TLS 1.2 and TLS 1.3 are the practical baseline for public sites. TLS 1.0 and 1.1 are deprecated and unsupported by current browsers.

Why did this appear after I updated my server?

A package update or changed defaults may have removed old protocols or ciphers that your config relied on, or your explicit cipher list may no longer match the key type.

Can a certificate cause this?

Not usually, except through the key-type/cipher mismatch described above. Expiry and name issues give certificate-specific errors.

Does this affect search engines?

Crawlers use modern TLS stacks. If browsers cannot connect, crawlers probably cannot either.

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.