ERR_SSL_VERSION_OR_CIPHER_MISMATCH: What It Means and How to Fix It
"Uses an unsupported protocol": browser and server share no TLS version or cipher. Old TLS 1.0/1.1, weak ciphers or a missing certificate (Cloudflare too), and how to fix it.
On this page
ERR_SSL_VERSION_OR_CIPHER_MISMATCH: what it means
Before an https page opens, the browser and the server do a short "handshake" (the TLS handshake). The browser says "I know these TLS versions and these encryption algorithms" and the server picks something from the list. If there is nothing in common, the conversation stops before it starts, like two people with no language in common.
Modern browsers only accept TLS 1.2 and TLS 1.3 and have dropped old, broken algorithms such as RC4 and 3DES. A server that offers only those can no longer talk to them. The same error also appears when the server has no certificate for the requested name and cuts the handshake off at the start.
How it looks in Chrome, Edge, Firefox and Safari
| Browser | What the page says | Code |
|---|---|---|
| Chrome | "This site can't provide a secure connection" and below it "X uses an unsupported protocol." | ERR_ |
| Edge | Same code as Chrome (Edge is built on Chromium), with its own wording on the page | ERR_ |
| Firefox | "Secure Connection Failed" | SSL_ (no shared algorithm) or SSL_ (unsupported TLS version) |
| Safari | "Safari Can't Open the Page" | — |
On Chrome's page you may also see the explanation "Unsupported protocol: The client and server don't support a common SSL protocol version or cipher suite." There is no button to proceed: a secure connection simply was not set up.
What happened to ERR_SSL_OBSOLETE_VERSION
Chrome used to show a full-page warning with the code ERR_ for sites using TLS 1.0 or 1.1, and you could still click past it. Since Chrome 98 (early 2022) that is no longer possible: such sites simply don't open and today usually show ERR_. Firefox also has TLS 1.0/1.1 disabled by default. If you find instructions to "enable old TLS" in your browser, they are out of date: the fix belongs on the server.
If you are a visitor
- Try another device or network. Open the site on your phone using mobile data. If it fails there too, the problem is on the site and can't be fixed on your side: let the owner know.
- Update your browser and operating system. A very old browser on an operating system that no longer gets updates may not "speak" the TLS versions or algorithms a modern server requires.
- Temporarily turn off your antivirus "HTTPS scanning", proxy or VPN. Such software sits between the browser and the site and, if outdated, can break the handshake.
- Check the address. A mistyped or retired subdomain may land on a server that has no certificate for that name.
If you own the website: the usual causes
- The server only accepts TLS 1.0 or 1.1. This happens with old servers, old Windows Server/IIS versions, NAS boxes, routers and control panels that haven't been updated in years. Enable TLS 1.2 and TLS 1.3 or update the software/firmware. If the site is hosted, ask your hosting provider.
- Only weak algorithms (ciphers). Cipher lists stuck with RC4 or 3DES, often from settings copied years ago. Use a modern list (e.g. ECDHE with AES-GCM or ChaCha20).
- No certificate for that name. Many sites share one IP address; the browser says up front which name it wants (SNI) and the server picks the matching certificate. If it has none for that name, some servers abort the handshake and the browser shows this error. Issue a certificate (e.g. the free Let's Encrypt) that covers the name, with and without www.
- Cloudflare: new domain or deep subdomain. When you add a domain to Cloudflare, its free certificate (Universal SSL) is usually issued within 15 minutes to 24 hours; until then you may see this error. Universal SSL also covers only the main domain and one level of subdomain (www.company.com, shop.company.com), not deeper names such as a.b.company.com. Those need an Advanced Certificate (or Total TLS) or your own certificate.
- TLS 1.3 only. The opposite extreme: if you keep only TLS 1.3, older visitor devices won't be able to connect. Keep TLS 1.2 and 1.3 together.
Check what your server accepts
The SSL Checker shows which TLS versions (1.0 to 1.3) and which algorithms the server accepts, whether any are weak, a compatibility list for browsers and devices and an A–F grade. If it can't even get a certificate ("No certificate found"), the server usually doesn't speak modern TLS for that name, exactly as the browser sees it. CT Watch shows whether a certificate has been publicly issued for a new subdomain.
→ SSL Checker → CT WatchMore: ERR_
Common mistakes
- Looking for a browser setting to "open" the site instead of fixing the server.
- Keeping only TLS 1.3 for "maximum security" and locking out older devices.
- Checking only the main domain and not the subdomain that shows the error: every name needs a certificate that covers it (or a wildcard).
- Changing settings in the first hours of a new domain on Cloudflare when the certificate simply hasn't been issued yet: first check that it shows "Active" on the Edge Certificates page.
- Forgetting devices such as a NAS, router or camera that have their own https admin page and old firmware.