---
title: "ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Cloudflare: cause…"
description: "Cloudflare's minimum TLS version setting is per-zone. Raising it to 1.3 blocks any client that cannot negotiate 1.3, which reads as a version mismatch to the…"
canonical: "https://lemwatch.com/errors/err-ssl-version-or-cipher-mismatch/in-cloudflare"
source: "https://lemwatch.com"
---

# ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Cloudflare

> Cloudflare's minimum TLS version setting is per-zone. Raising it to 1.3 blocks any client that cannot negotiate 1.3, which reads as a version mismatch to the visitor.

## Why it happens on Cloudflare

 Cloudflare's minimum TLS version setting is per-zone. Raising it to 1.3 blocks any client that cannot negotiate 1.3, which reads as a version mismatch to the visitor.

## The fix on Cloudflare

 SSL/TLS → Edge Certificates → Minimum TLS Version: set 1.2 unless you have a compliance reason for 1.3. Leave Opportunistic Encryption on.

## If that didn't fix it

 Cloudflare has its own failure mode, but ERR_SSL_VERSION_OR_CIPHER_MISMATCH has a wider set of causes. The most common one overall is: The server only supports TLS 1.0 or 1.1.

 Enable TLS 1.2 and 1.3. On nginx: `ssl_protocols TLSv1.2 TLSv1.3;` then reload.

## Check your own domain

 The SSL check enumerates exactly which protocol versions and suites the server accepts, turning guesswork into a list.

## Frequently asked questions

### Why does ERR_SSL_VERSION_OR_CIPHER_MISMATCH happen on Cloudflare?

 Cloudflare's minimum TLS version setting is per-zone. Raising it to 1.3 blocks any client that cannot negotiate 1.3, which reads as a version mismatch to the visitor.

### How do I fix ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Cloudflare?

 SSL/TLS → Edge Certificates → Minimum TLS Version: set 1.2 unless you have a compliance reason for 1.3. Leave Opportunistic Encryption on.

### What does ERR_SSL_VERSION_OR_CIPHER_MISMATCH mean?

 The browser and server have no protocol version or cipher suite in common, so the handshake ends before it starts. Almost always an origin still pinned to TLS 1.0/1.1 or an ancient cipher list.


## Related

- [All causes of ERR_SSL_VERSION_OR_CIPHER_MISMATCH](https://lemwatch.com/errors/err-ssl-version-or-cipher-mismatch)
- [All website error codes](https://lemwatch.com/errors)
- [ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Nginx](https://lemwatch.com/errors/err-ssl-version-or-cipher-mismatch/in-nginx)
- [ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Chrome](https://lemwatch.com/errors/err-ssl-version-or-cipher-mismatch/on-chrome)
- [Free SSL certificate check](https://lemwatch.com/tools/ssl-checker)
- [All monitoring checks](https://lemwatch.com/features)