ERR_SSL_PROTOCOL_ERROR on Mac

Safari and Chrome on macOS both use the system Keychain, so a stale or manually-trusted root certificate breaks every browser at once — and macOS still fails hard on servers that only offer TLS 1.0/1.1.

Why it happens on Mac

Safari and Chrome on macOS both use the system Keychain, so a stale or manually-trusted root certificate breaks every browser at once — and macOS still fails hard on servers that only offer TLS 1.0/1.1.

The fix on Mac

Open Keychain Access → System Roots, search the issuing CA and remove any manually added duplicate set to 'Never Trust'. Then run the SSL check below: if it reports TLS 1.2 or higher missing, the fix is on the server, not the Mac.

If that didn't fix it

Mac has its own failure mode, but ERR_SSL_PROTOCOL_ERROR has a wider set of causes. The most common one overall is: The server only offers TLS 1.0 or TLS 1.1, which every current browser has disabled.

Enable TLS 1.2 and TLS 1.3 on the origin and remove the deprecated versions. On nginx set `ssl_protocols TLSv1.2 TLSv1.3;` and reload.

Check your own domain

The SSL checker reads the live handshake: protocol versions offered, cipher suites, chain completeness and expiry. If it cannot complete the handshake either, the fault is server-side and not your browser.

Frequently asked questions

Why does ERR_SSL_PROTOCOL_ERROR happen on Mac?

Safari and Chrome on macOS both use the system Keychain, so a stale or manually-trusted root certificate breaks every browser at once — and macOS still fails hard on servers that only offer TLS 1.0/1.1.

How do I fix ERR_SSL_PROTOCOL_ERROR on Mac?

Open Keychain Access → System Roots, search the issuing CA and remove any manually added duplicate set to 'Never Trust'. Then run the SSL check below: if it reports TLS 1.2 or higher missing, the fix is on the server, not the Mac.

What does ERR_SSL_PROTOCOL_ERROR mean?

Chrome tried to start an encrypted connection and the server answered with something that is not valid TLS. In almost every case the server is offering a protocol version or cipher the browser refuses, the certificate is broken, or something on the network is intercepting the handshake.