---
title: "ERR_SSL_PROTOCOL_ERROR on Mac: cause and fix"
description: "Safari and Chrome on macOS both use the system Keychain, so a stale or manually-trusted root certificate breaks every browser at once — and macOS still fails…"
canonical: "https://lemwatch.com/errors/err-ssl-protocol-error/on-mac"
source: "https://lemwatch.com"
---

# ERR_SSL_PROTOCOL_ERROR on Mac

> Safari and Chrome on macOS both use the system Keychain, so a stale or manually-trusted root certificate breaks every browser at once — and macOS still fails hard on servers that only offer TLS 1.0/1.1.

## Why it happens on Mac

 Safari and Chrome on macOS both use the system Keychain, so a stale or manually-trusted root certificate breaks every browser at once — and macOS still fails hard on servers that only offer TLS 1.0/1.1.

## The fix on Mac

 Open Keychain Access → System Roots, search the issuing CA and remove any manually added duplicate set to 'Never Trust'. Then run the SSL check below: if it reports TLS 1.2 or higher missing, the fix is on the server, not the Mac.

## If that didn't fix it

 Mac has its own failure mode, but ERR_SSL_PROTOCOL_ERROR has a wider set of causes. The most common one overall is: The server only offers TLS 1.0 or TLS 1.1, which every current browser has disabled.

 Enable TLS 1.2 and TLS 1.3 on the origin and remove the deprecated versions. On nginx set `ssl_protocols TLSv1.2 TLSv1.3;` and reload.

## Check your own domain

 The SSL checker reads the live handshake: protocol versions offered, cipher suites, chain completeness and expiry. If it cannot complete the handshake either, the fault is server-side and not your browser.

## Frequently asked questions

### Why does ERR_SSL_PROTOCOL_ERROR happen on Mac?

 Safari and Chrome on macOS both use the system Keychain, so a stale or manually-trusted root certificate breaks every browser at once — and macOS still fails hard on servers that only offer TLS 1.0/1.1.

### How do I fix ERR_SSL_PROTOCOL_ERROR on Mac?

 Open Keychain Access → System Roots, search the issuing CA and remove any manually added duplicate set to 'Never Trust'. Then run the SSL check below: if it reports TLS 1.2 or higher missing, the fix is on the server, not the Mac.

### What does ERR_SSL_PROTOCOL_ERROR mean?

 Chrome tried to start an encrypted connection and the server answered with something that is not valid TLS. In almost every case the server is offering a protocol version or cipher the browser refuses, the certificate is broken, or something on the network is intercepting the handshake.


## Related

- [All causes of ERR_SSL_PROTOCOL_ERROR](https://lemwatch.com/errors/err-ssl-protocol-error)
- [All website error codes](https://lemwatch.com/errors)
- [ERR_SSL_PROTOCOL_ERROR on Windows](https://lemwatch.com/errors/err-ssl-protocol-error/on-windows)
- [ERR_SSL_PROTOCOL_ERROR on Nginx](https://lemwatch.com/errors/err-ssl-protocol-error/in-nginx)
- [ERR_SSL_PROTOCOL_ERROR on Chrome](https://lemwatch.com/errors/err-ssl-protocol-error/on-chrome)
- [Free SSL certificate check](https://lemwatch.com/tools/ssl-checker)
- [ERR_SSL_PROTOCOL_ERROR on iPhone](https://lemwatch.com/errors/err-ssl-protocol-error/on-iphone)
- [Lemwatch pricing](https://lemwatch.com/pricing)