SSL protocol error: what it means and how to fix it
In short
ERR_SSL_PROTOCOL_ERROR means that the server answered an attempt to open an encrypted connection with something the browser cannot understand; most often plain http runs on port 443 because SSL is not enabled for the domain. The site owner enables SSL and installs a certificate. A visitor can try another network and check antivirus software, then let the owner know.
“This site can’t provide a secure connection”: what it means
Chrome starts its message with this heading when it could not open an encrypted connection to the site. Below the heading is one of two sentences, and below that the error code:
| Sentence below the heading | Error code | What it means |
|---|---|---|
| “example.com sent an invalid response.” | ERR_SSL_PROTOCOL_ERROR | the server answered with something the browser does not recognize as an encrypted connection; most often plain http on port 443 |
| “example.com uses an unsupported protocol.” | ERR_SSL_VERSION_OR_CIPHER_MISMATCH | the server supports only old versions of encryption (e.g. TLS 1.0 and 1.1), which browsers no longer use |
Edge shows the same codes. In the first case Firefox usually shows “Secure Connection Failed” with the code SSL_ERROR_RX_RECORD_TOO_LONG.
This is not a certificate warning, so the browser does not let you continue to the site. In Chrome Help, Google advises contacting the website owner about this message.
If it is someone else’s website
- Reload the page. If the error appears only on this one site while others work, the problem is most likely on its server.
- Open the site in an Incognito window. If it works there, turn off your browser extensions and turn them back on one at a time to find the one that causes the problem.
- Try the site on another network, e.g. on your phone using mobile data. If it works there, check your antivirus software and firewall (some of them inspect encrypted connections), and your VPN or proxy server if you use one. At work, ask your IT department.
- If the site does not work anywhere, write to its owner. You cannot fix a server-side error yourself.
A wrong date on your device gives a different message: “Your clock is ahead” or a certificate warning.
Where an SSL protocol error on your site comes from
- Plain http runs on port 443. This is the most common cause: SSL is not enabled for the domain in your hosting panel, or encryption is not turned on for port 443 in the server configuration. Details and fixes are in the guide SSL_ERROR_RX_RECORD_TOO_LONG.
- An incomplete or broken encryption configuration. The server stops the setup of the encrypted connection with an error message, e.g. after a manual change to the configuration. Chrome reports most such failures with the same code.
- An old version of encryption gives the code
ERR_SSL_VERSION_OR_CIPHER_MISMATCH. Browsers now require at least TLS 1.2.
How to fix the error on your own site
- Open the site in Firefox. If it shows
SSL_ERROR_RX_RECORD_TOO_LONG, the server answers with plain http: follow the steps in the guide on that error. - On hosting: enable SSL for the domain (“Secure SSL” in DirectAdmin, “SSL/TLS support” in Plesk), install the certificate following the guide for your hosting and assign it to the domain. You can generate a certificate in the generator.
- On your own server: check the configuration (
sudo nginx -torsudo apachectl configtest) and the server’s error log from the moment you opened the site. In nginx, port 443 needslisten 443 ssl;, in Apache a<VirtualHost *:443>block withSSLEngine on. The full installation is described in the server guide. - With the code
ERR_SSL_VERSION_OR_CIPHER_MISMATCH: in nginx, thessl_protocolsline should includeTLSv1.2 TLSv1.3. On hosting, ask the support team to enable TLS 1.2 and 1.3. - If the error remains after these fixes, contact your hosting provider’s support and give them the error code and the site address.