SSL_ERROR_RX_RECORD_TOO_LONG: what it means and how to fix it

What Firefox shows and what it means

Firefox shows the page “Secure Connection Failed” with the sentence “SSL received a record that exceeded the maximum permissible length.”. After you click “Advanced”, you see the code SSL_ERROR_RX_RECORD_TOO_LONG and a request to inform the website owners. You cannot bypass this warning.

The name sounds technical, but the cause is usually simple. For an https:// address the browser starts an encrypted connection on port 443, and the server answers with plain, unencrypted http. Firefox reads the first characters of that answer as the header of an encrypted block of data (a record), and the block it gets is longer than the protocol allows.

In the same situation Chrome shows “This site can’t provide a secure connection” with the code ERR_SSL_PROTOCOL_ERROR, and Edge shows the same code. We cover it on the page SSL protocol error.

If it is someone else’s website

• Check that the address does not contain a port number, e.g. https://example.com:8080. Type just the site address.
• Open the site on another network, e.g. on your phone using mobile data. If it works there, and on your network this error appears on many sites, the cause may be antivirus software that inspects https connections, or a proxy server on a company network. Update the antivirus program or briefly turn off its scanning of encrypted connections; at work, ask your IT department.
• If the site does not work on any network, the problem is on the server and you cannot fix it yourself. Firefox then says: “Please contact the website owners to inform them of this problem.”

The most common causes on your own site

• SSL is not enabled for the domain. The site works over http://, but SSL is turned off in the domain settings of your hosting, or no certificate is assigned to the domain.
• A mistake in your own server configuration. The server listens on port 443 but without encryption: in nginx the word ssl is missing from the listen 443 line, and in Apache the line SSLEngine on, a <VirtualHost *:443> block for the domain or the mod_ssl module is missing.
• A link with a port number where plain http runs, e.g. https://example.com:8080.

How to fix it on hosting with a control panel

1. In your hosting panel, open the domain settings and enable SSL. In DirectAdmin the option is called “Secure SSL”, in Plesk “SSL/TLS support”. In other panels, look for an option to enable SSL next to the domain.
2. Install a certificate and assign it to the domain. If you do not have one, generate it in the generator for all of the site’s addresses, e.g. example.com, www.example.com, and upload it following the guide for your hosting.
3. Open the site over https:// in a private window. If instead of this error you see a warning about a certificate issued for a different address, go to the guide SSL_ERROR_BAD_CERT_DOMAIN.
4. If everything is enabled in the panel and the error remains, contact your hosting provider’s support: the port 443 configuration is then on their side.

How to fix it on your own server (nginx, Apache)

nginx: in the server block for your domain, the line listen 443; without the word ssl runs plain http on port 443. Correct:

listen 443 ssl;
ssl_certificate     /etc/ssl/yourdomain/fullchain.pem;
ssl_certificate_key /etc/ssl/yourdomain/privkey.pem;

If the block also has a listen [::]:443 line, it needs the word ssl too. Check the configuration with sudo nginx -t and reload the server: sudo systemctl reload nginx.

Apache: turn on the SSL module (Debian and Ubuntu: sudo a2enmod ssl, then sudo systemctl restart apache2; AlmaLinux and Rocky Linux: sudo dnf install mod_ssl). The domain needs a <VirtualHost *:443> block with SSL turned on, because Apache does not turn it on by default:

SSLEngine on
SSLCertificateFile    /etc/ssl/yourdomain/fullchain.pem
SSLCertificateKeyFile /etc/ssl/yourdomain/privkey.pem

Check the configuration with sudo apachectl configtest, then reload the server: sudo systemctl reload apache2 (on AlmaLinux and Rocky Linux, httpd). The full installation is described in the server guide.

On a computer with a terminal you can check what the server answers:

echo | openssl s_client -connect example.com:443 \
  -servername example.com

If the output contains wrong version number, the server still answers with plain http on port 443. A correctly configured server shows its certificate and the connection details.