TLS & certificate errors

    ERR_SSL_PROTOCOL_ERROR: The site sent an invalid response

    Also searched as: net::ERR_SSL_PROTOCOL_ERROR · SSL protocol error · sent an invalid response

    Is ERR_SSL_PROTOCOL_ERROR happening on your domain?

    The SSL checker reads the live handshake: protocol versions offered, cipher suites, chain completeness and expiry. If it cannot complete the handshake either, the fault is server-side and not your browser.

    Free, no signup. Runs from outside your network, which is the only way to tell a server fault from a local one.

    Short answer

    Chrome tried to start an encrypted connection and the server answered with something that is not valid TLS. In almost every case the server is offering a protocol version or cipher the browser refuses, the certificate is broken, or something on the network is intercepting the handshake.

    What ERR_SSL_PROTOCOL_ERROR means

    ERR_SSL_PROTOCOL_ERROR is Chrome's generic TLS handshake failure. The browser opened a socket on port 443, sent a ClientHello, and the reply was either malformed, unencrypted, or used a protocol the browser has disabled. Unlike a certificate warning there is no "proceed anyway" option, because no secure channel was ever established.

    Causes and fixes, most likely first

    most common

    The server only offers TLS 1.0 or TLS 1.1, which every current browser has disabled.

    Enable TLS 1.2 and TLS 1.3 on the origin and remove the deprecated versions. On nginx set `ssl_protocols TLSv1.2 TLSv1.3;` and reload.

    common

    Port 443 is serving plain HTTP, so the TLS handshake gets an HTTP response instead of a ServerHello.

    Check the vhost bound to 443 actually has `ssl on` / a certificate configured. A `listen 443;` without `ssl` produces exactly this error.

    common

    The certificate chain is incomplete or the wrong certificate is served for the hostname.

    Serve the full chain (leaf + intermediates), not just the leaf. Run an SSL check on the hostname and confirm the chain resolves to a trusted root.

    occasional

    Antivirus TLS scanning, a corporate proxy, or a VPN is intercepting and mangling the handshake.

    Disable HTTPS/SSL scanning in the antivirus, or test from a different network. If the error disappears off-network, the interception device is the cause.

    occasional

    A stale local TLS session cache in the browser.

    Clear the browser's SSL state and hard-reload. This only ever fixes the error for you, never for visitors — if a check from outside also fails, the server is at fault.

    ERR_SSL_PROTOCOL_ERROR on specific platforms and devices

    ERR_SSL_PROTOCOL_ERROR on MacSafari and Chrome on macOS both use the system Keychain, so a stale or manually-trusted root certificate breaks every browser at once — and macOS still fails hard on servers that only offer TLS 1.0/1.1.ERR_SSL_PROTOCOL_ERROR on WindowsWindows routes HTTPS through Schannel, so a disabled TLS 1.2 registry key or an antivirus product that intercepts HTTPS (Avast, ESET, Kaspersky) rewrites the handshake with its own certificate and Chrome rejects it.ERR_SSL_PROTOCOL_ERROR on NginxNginx serves the wrong certificate chain when ssl_certificate points at the leaf file instead of the fullchain bundle, so the handshake dies before any HTTP response is written.ERR_SSL_PROTOCOL_ERROR on ChromeChrome disabled TLS 1.0/1.1 outright and enforces certificate transparency, so it fails where older browsers still connect.ERR_SSL_PROTOCOL_ERROR on AndroidAndroid devices with a wrong system clock, or an old WebView, reject otherwise valid certificates during the handshake.ERR_SSL_PROTOCOL_ERROR on iPhoneSafari and iOS Chrome share the system TLS stack, so a configuration profile, a content blocker, or a VPN profile can break the handshake for every browser at once.ERR_SSL_PROTOCOL_ERROR on WordPressA WordPress site behind a host that terminates TLS separately often ends up with the site URL forced to https:// while the vhost on 443 has no certificate — the redirect loops straight into a failed handshake.ERR_SSL_PROTOCOL_ERROR on CloudflareCloudflare's SSL mode is set to Full (Strict) but the origin serves a self-signed or expired certificate, so Cloudflare refuses the origin handshake and Chrome sees the failure.

    How to stop it happening again

    • •Pin a minimum of TLS 1.2 and keep TLS 1.3 enabled, then re-test after every server or CDN change.
    • •Monitor the certificate chain, not just the expiry date — an intermediate rotating out is a silent break.
    • •Alert on handshake failure, not just on HTTP status: a broken handshake often still returns a 200 from a health check hitting port 80.

    Frequently asked questions

    How do I fix ERR_SSL_PROTOCOL_ERROR?

    Start server-side: confirm port 443 is serving TLS 1.2/1.3 with a complete certificate chain. If an external SSL check completes cleanly, the problem is local — disable antivirus HTTPS scanning, clear the browser SSL state, and retry.

    What does ERR_SSL_PROTOCOL_ERROR mean?

    It means the TLS handshake failed before any encrypted data was exchanged. The server's reply was not valid TLS the browser could accept.

    Is ERR_SSL_PROTOCOL_ERROR my fault or the website's?

    If the site fails for everyone, it is the server. If it fails only for you, suspect antivirus TLS interception, a proxy, or a stale local SSL cache. An external check settles it in seconds.

    Can I bypass ERR_SSL_PROTOCOL_ERROR?

    No. Unlike a certificate warning there is no bypass, because no secure connection was ever negotiated. The server has to be fixed.

    Related errors

    ERR_CERT_DATE_INVALID
    ERR_SSL_VERSION_OR_CIPHER_MISMATCH
    SSL handshake failed
    Your connection is not private
    HTTP 495

    Monitor this continuously with LemWatch

    A one-off err_ssl_protocol_error monitoring shows you today. LemWatch re-runs the same checks around the clock and alerts you the moment something breaks — free for up to 10 sites, no card needed.

    Last verified: by the Lemwatch research team.