ERR_SSL_PROTOCOL_ERROR on Windows

Windows routes HTTPS through Schannel, so a disabled TLS 1.2 registry key or an antivirus product that intercepts HTTPS (Avast, ESET, Kaspersky) rewrites the handshake with its own certificate and Chrome rejects it.

Why it happens on Windows

Windows routes HTTPS through Schannel, so a disabled TLS 1.2 registry key or an antivirus product that intercepts HTTPS (Avast, ESET, Kaspersky) rewrites the handshake with its own certificate and Chrome rejects it.

The fix on Windows

Turn off 'HTTPS scanning' or 'SSL/TLS protocol filtering' in your antivirus and reload. If that fixes it, add the site to the antivirus exclusion list. If not, run 'Internet Options → Advanced' and confirm TLS 1.2 and TLS 1.3 are ticked.

If that didn't fix it

Windows has its own failure mode, but ERR_SSL_PROTOCOL_ERROR has a wider set of causes. The most common one overall is: The server only offers TLS 1.0 or TLS 1.1, which every current browser has disabled.

Enable TLS 1.2 and TLS 1.3 on the origin and remove the deprecated versions. On nginx set `ssl_protocols TLSv1.2 TLSv1.3;` and reload.

Check your own domain

The SSL checker reads the live handshake: protocol versions offered, cipher suites, chain completeness and expiry. If it cannot complete the handshake either, the fault is server-side and not your browser.

Frequently asked questions

Why does ERR_SSL_PROTOCOL_ERROR happen on Windows?

Windows routes HTTPS through Schannel, so a disabled TLS 1.2 registry key or an antivirus product that intercepts HTTPS (Avast, ESET, Kaspersky) rewrites the handshake with its own certificate and Chrome rejects it.

How do I fix ERR_SSL_PROTOCOL_ERROR on Windows?

Turn off 'HTTPS scanning' or 'SSL/TLS protocol filtering' in your antivirus and reload. If that fixes it, add the site to the antivirus exclusion list. If not, run 'Internet Options → Advanced' and confirm TLS 1.2 and TLS 1.3 are ticked.

What does ERR_SSL_PROTOCOL_ERROR mean?

Chrome tried to start an encrypted connection and the server answered with something that is not valid TLS. In almost every case the server is offering a protocol version or cipher the browser refuses, the certificate is broken, or something on the network is intercepting the handshake.