ERR_SSL_VERSION_OR_CIPHER_MISMATCH: causes and fixes
The browser can’t establish a secure connection: how to find and fix old TLS versions, incompatible ciphers, a missing certificate and wrong virtual-host settings.
Tutorials · 3 min read
If the browser says “This site can’t provide a secure connection” with ERR_SSL_VERSION_OR_CIPHER_MISMATCH underneath, the browser and the server couldn’t agree on a common secure-communication format (TLS version and cipher suite). Most of the time the problem is on the server side and can be fixed.
Possible causes
| Cause | Explanation |
|---|---|
| Old TLS versions | The server only offers TLS 1.0/1.1; modern browsers require at least TLS 1.2 |
| Old cipher suites | Ciphers such as RC4 and 3DES, now considered insecure |
| SSL not installed | There is no certificate for the domain; the server presents another domain’s certificate |
| Wrong port / virtual host | Port 443 answers plain HTTP instead of HTTPS, or SSL isn’t enabled |
| CDN/proxy mismatch | The SSL mode between the CDN and the origin doesn’t match |
| A very old client | An old operating system/browser doesn’t recognise new certificates and ciphers |
1. Work out whether it’s you or the server
- Open the site from another browser and another device. If only an old device has the problem, the client needs updating.
- Make sure the system clock is right; a wrong clock breaks secure connections.
2. Test the server from the command line
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com -tls1_2If it can’t connect or no certificate appears, SSL isn’t configured correctly. Online “SSL test” tools show the supported TLS versions and ciphers in detail.
3. If you use hosting
- In the hosting control panel confirm an SSL certificate is installed for the domain; if not, get the free certificate.
- Make sure both the
wwwand non-wwwaddresses are in the certificate. - Check that the domain’s DNS record points to the right server (see DNS records).
4. If you run your own server
A modern configuration offers only TLS 1.2 and 1.3.
Nginx:
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;Apache:
SSLProtocol -all +TLSv1.2 +TLSv1.3Test the configuration and reload:
sudo nginx -t && sudo systemctl reload nginx
sudo apachectl configtest && sudo systemctl reload apache2Also make sure the server block for 443 has listen 443 ssl; (Nginx) or <VirtualHost *:443> and SSLEngine on (Apache). If you use a reverse proxy, Caddy, which manages certificates automatically, removes most of these errors.
5. If you use a CDN or proxy
Choose the CDN’s SSL mode to match your origin: if the origin has a valid certificate use the fully verified mode, otherwise install a certificate on the origin first. If the origin is also contacted over HTTPS, keep its TLS versions current as above.
6. Check certificate renewal
An expired certificate gives a different error, but if automatic renewal failed the server may answer with an old or missing certificate. If you use a free certificate, make sure the domain’s DNS is right and ports 80/443 are open.
Still not solved?
Open a ticket and include your domain, a screenshot of the error and the openssl s_client output.
