TLS & certificate errors

    ERR_SSL_VERSION_OR_CIPHER_MISMATCH: No shared TLS version or cipher suite

    Also searched as: net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH · cipher mismatch · no cipher overlap

    Is ERR_SSL_VERSION_OR_CIPHER_MISMATCH happening on your domain?

    The SSL check enumerates exactly which protocol versions and suites the server accepts, turning guesswork into a list.

    Free, no signup. Runs from outside your network, which is the only way to tell a server fault from a local one.

    Short answer

    The browser and server have no protocol version or cipher suite in common, so the handshake ends before it starts. Almost always an origin still pinned to TLS 1.0/1.1 or an ancient cipher list.

    What ERR_SSL_VERSION_OR_CIPHER_MISMATCH means

    During the ClientHello the browser advertises the TLS versions and cipher suites it supports. If the server's list has no overlap, it aborts. Modern browsers dropped TLS 1.0/1.1, RC4, 3DES and non-forward-secret suites, so any server still restricted to those becomes unreachable.

    Causes and fixes, most likely first

    most common

    The server only supports TLS 1.0 or 1.1.

    Enable TLS 1.2 and 1.3. On nginx: `ssl_protocols TLSv1.2 TLSv1.3;` then reload.

    common

    An over-tightened cipher list excludes everything current browsers offer.

    Replace hand-written cipher strings with a maintained recommended configuration rather than curating suites manually.

    occasional

    An RSA-only certificate paired with an ECDSA-only cipher list, or the reverse.

    Make sure the certificate key type matches the cipher suites enabled, or serve both an RSA and an ECDSA certificate.

    ERR_SSL_VERSION_OR_CIPHER_MISMATCH on specific platforms and devices

    ERR_SSL_VERSION_OR_CIPHER_MISMATCH on NginxAn ssl_ciphers line copied from an old hardening guide can leave the server offering only ciphers Chrome removed, so the handshake ends with no shared suite.ERR_SSL_VERSION_OR_CIPHER_MISMATCH on CloudflareCloudflare's minimum TLS version setting is per-zone. Raising it to 1.3 blocks any client that cannot negotiate 1.3, which reads as a version mismatch to the visitor.ERR_SSL_VERSION_OR_CIPHER_MISMATCH on ChromeChrome dropped TLS 1.0 and 1.1 and refuses RC4 and 3DES, so a server that still works in curl or an internal tool fails only in the browser.

    How to stop it happening again

    • •Re-test TLS configuration after every server upgrade — distribution defaults change and can silently drop suites.
    • •Track the minimum TLS version your real visitors negotiate before removing an old one.

    Frequently asked questions

    Which TLS versions should I support in 2026?

    TLS 1.2 and TLS 1.3. TLS 1.0 and 1.1 are disabled in every current browser, and supporting them no longer buys compatibility.

    Related errors

    ERR_SSL_PROTOCOL_ERROR
    SSL handshake failed
    ERR_SSL_OBSOLETE_VERSION

    Monitor this continuously with LemWatch

    A one-off err_ssl_version_or_cipher_mismatch monitoring shows you today. LemWatch re-runs the same checks around the clock and alerts you the moment something breaks — free for up to 10 sites, no card needed.

    Last verified: by the Lemwatch research team.