---
title: "ERR_SSL_VERSION_OR_CIPHER_MISMATCH: causes and how to fix it"
description: "The browser and server have no protocol version or cipher suite in common, so the handshake ends before it starts. Almost always an origin still pinned to…"
canonical: "https://lemwatch.com/errors/err-ssl-version-or-cipher-mismatch"
source: "https://lemwatch.com"
---

# ERR_SSL_VERSION_OR_CIPHER_MISMATCH: No shared TLS version or cipher suite

> The browser and server have no protocol version or cipher suite in common, so the handshake ends before it starts. Almost always an origin still pinned to TLS 1.0/1.1 or an ancient cipher list.

## Short answer

 The browser and server have no protocol version or cipher suite in common, so the handshake ends before it starts. Almost always an origin still pinned to TLS 1.0/1.1 or an ancient cipher list.

## What ERR_SSL_VERSION_OR_CIPHER_MISMATCH means

 During the ClientHello the browser advertises the TLS versions and cipher suites it supports. If the server's list has no overlap, it aborts. Modern browsers dropped TLS 1.0/1.1, RC4, 3DES and non-forward-secret suites, so any server still restricted to those becomes unreachable.

## Causes and fixes, most likely first

- The server only supports TLS 1.0 or 1.1. Enable TLS 1.2 and 1.3. On nginx: `ssl_protocols TLSv1.2 TLSv1.3;` then reload.
- An over-tightened cipher list excludes everything current browsers offer. Replace hand-written cipher strings with a maintained recommended configuration rather than curating suites manually.
- An RSA-only certificate paired with an ECDSA-only cipher list, or the reverse. Make sure the certificate key type matches the cipher suites enabled, or serve both an RSA and an ECDSA certificate.

## ERR_SSL_VERSION_OR_CIPHER_MISMATCH on specific platforms

- ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Nginx — An ssl_ciphers line copied from an old hardening guide can leave the server offering only ciphers Chrome removed, so the handshake ends…
- ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Cloudflare — Cloudflare's minimum TLS version setting is per-zone. Raising it to 1.3 blocks any client that cannot negotiate 1.3, which reads as a…
- ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Chrome — Chrome dropped TLS 1.0 and 1.1 and refuses RC4 and 3DES, so a server that still works in curl or an internal tool fails only in the browser.

## How to stop it happening again

- Re-test TLS configuration after every server upgrade — distribution defaults change and can silently drop suites.
- Track the minimum TLS version your real visitors negotiate before removing an old one.

## Check your own domain

 The SSL check enumerates exactly which protocol versions and suites the server accepts, turning guesswork into a list.

## Frequently asked questions

### Which TLS versions should I support in 2026?

 TLS 1.2 and TLS 1.3. TLS 1.0 and 1.1 are disabled in every current browser, and supporting them no longer buys compatibility.


## Related

- [All website error codes](https://lemwatch.com/errors)
- [ERR_SSL_PROTOCOL_ERROR](https://lemwatch.com/errors/err-ssl-protocol-error)
- [SSL handshake failed](https://lemwatch.com/errors/ssl-handshake-failed)
- [ERR_SSL_OBSOLETE_VERSION](https://lemwatch.com/errors/err-ssl-obsolete-version)
- [Free SSL certificate check](https://lemwatch.com/tools/ssl-checker)
- [ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Cloudflare](https://lemwatch.com/errors/err-ssl-version-or-cipher-mismatch/in-cloudflare)
- [ERR_SSL_PROTOCOL_ERROR on Windows](https://lemwatch.com/errors/err-ssl-protocol-error/on-windows)
- [All monitoring checks](https://lemwatch.com/features)