--- title: "ERR_SSL_PROTOCOL_ERROR: causes and how to fix it" description: "Chrome tried to start an encrypted connection and the server answered with something that is not valid TLS. In almost every case the server is offering a…" canonical: "https://lemwatch.com/errors/err-ssl-protocol-error" source: "https://lemwatch.com" --- # ERR_SSL_PROTOCOL_ERROR: The site sent an invalid response > Chrome tried to start an encrypted connection and the server answered with something that is not valid TLS. In almost every case the server is offering a protocol version or cipher the browser refuses, the certificate is broken, or something on the network is… ## Short answer Chrome tried to start an encrypted connection and the server answered with something that is not valid TLS. In almost every case the server is offering a protocol version or cipher the browser refuses, the certificate is broken, or something on the network is intercepting the handshake. ## What ERR_SSL_PROTOCOL_ERROR means ERR_SSL_PROTOCOL_ERROR is Chrome's generic TLS handshake failure. The browser opened a socket on port 443, sent a ClientHello, and the reply was either malformed, unencrypted, or used a protocol the browser has disabled. Unlike a certificate warning there is no "proceed anyway" option, because no secure channel was ever established. ## Causes and fixes, most likely first - The server only offers TLS 1.0 or TLS 1.1, which every current browser has disabled. Enable TLS 1.2 and TLS 1.3 on the origin and remove the deprecated versions. On nginx set `ssl_protocols TLSv1.2 TLSv1.3;` and reload. - Port 443 is serving plain HTTP, so the TLS handshake gets an HTTP response instead of a ServerHello. Check the vhost bound to 443 actually has `ssl on` / a certificate configured. A `listen 443;` without `ssl` produces exactly this error. - The certificate chain is incomplete or the wrong certificate is served for the hostname. Serve the full chain (leaf + intermediates), not just the leaf. Run an SSL check on the hostname and confirm the chain resolves to a trusted root. - Antivirus TLS scanning, a corporate proxy, or a VPN is intercepting and mangling the handshake. Disable HTTPS/SSL scanning in the antivirus, or test from a different network. If the error disappears off-network, the interception device is the cause. - A stale local TLS session cache in the browser. Clear the browser's SSL state and hard-reload. This only ever fixes the error for you, never for visitors — if a check from outside also fails, the server is at fault. ## ERR_SSL_PROTOCOL_ERROR on specific platforms - ERR_SSL_PROTOCOL_ERROR on Mac — Safari and Chrome on macOS both use the system Keychain, so a stale or manually-trusted root certificate breaks every browser at once — and… - ERR_SSL_PROTOCOL_ERROR on Windows — Windows routes HTTPS through Schannel, so a disabled TLS 1.2 registry key or an antivirus product that intercepts HTTPS (Avast, ESET,… - ERR_SSL_PROTOCOL_ERROR on Nginx — Nginx serves the wrong certificate chain when ssl_certificate points at the leaf file instead of the fullchain bundle, so the handshake… - ERR_SSL_PROTOCOL_ERROR on Chrome — Chrome disabled TLS 1.0/1.1 outright and enforces certificate transparency, so it fails where older browsers still connect. - ERR_SSL_PROTOCOL_ERROR on Android — Android devices with a wrong system clock, or an old WebView, reject otherwise valid certificates during the handshake. - ERR_SSL_PROTOCOL_ERROR on iPhone — Safari and iOS Chrome share the system TLS stack, so a configuration profile, a content blocker, or a VPN profile can break the handshake… - ERR_SSL_PROTOCOL_ERROR on WordPress — A WordPress site behind a host that terminates TLS separately often ends up with the site URL forced to https:// while the vhost on 443 has… - ERR_SSL_PROTOCOL_ERROR on Cloudflare — Cloudflare's SSL mode is set to Full (Strict) but the origin serves a self-signed or expired certificate, so Cloudflare refuses the origin… ## How to stop it happening again - Pin a minimum of TLS 1.2 and keep TLS 1.3 enabled, then re-test after every server or CDN change. - Monitor the certificate chain, not just the expiry date — an intermediate rotating out is a silent break. - Alert on handshake failure, not just on HTTP status: a broken handshake often still returns a 200 from a health check hitting port 80. ## Check your own domain The SSL checker reads the live handshake: protocol versions offered, cipher suites, chain completeness and expiry. If it cannot complete the handshake either, the fault is server-side and not your browser. ## Frequently asked questions ### How do I fix ERR_SSL_PROTOCOL_ERROR? Start server-side: confirm port 443 is serving TLS 1.2/1.3 with a complete certificate chain. If an external SSL check completes cleanly, the problem is local — disable antivirus HTTPS scanning, clear the browser SSL state, and retry. ### What does ERR_SSL_PROTOCOL_ERROR mean? It means the TLS handshake failed before any encrypted data was exchanged. The server's reply was not valid TLS the browser could accept. ### Is ERR_SSL_PROTOCOL_ERROR my fault or the website's? If the site fails for everyone, it is the server. If it fails only for you, suspect antivirus TLS interception, a proxy, or a stale local SSL cache. An external check settles it in seconds. ### Can I bypass ERR_SSL_PROTOCOL_ERROR? No. Unlike a certificate warning there is no bypass, because no secure connection was ever negotiated. The server has to be fixed. ## Related - [All website error codes](https://lemwatch.com/errors) - [ERR_CERT_DATE_INVALID](https://lemwatch.com/errors/err-cert-date-invalid) - [ERR_SSL_VERSION_OR_CIPHER_MISMATCH](https://lemwatch.com/errors/err-ssl-version-or-cipher-mismatch) - [SSL handshake failed](https://lemwatch.com/errors/ssl-handshake-failed) - [Your connection is not private](https://lemwatch.com/errors/your-connection-is-not-private) - [HTTP 495](https://lemwatch.com/http-status-codes/495) - [Free SSL certificate check](https://lemwatch.com/tools/ssl-checker) - [ERR_SSL_PROTOCOL_ERROR on Cloudflare](https://lemwatch.com/errors/err-ssl-protocol-error/in-cloudflare)