An ssl_ciphers line copied from an old hardening guide can leave the server offering only ciphers Chrome removed, so the handshake ends with no shared suite.
An ssl_ciphers line copied from an old hardening guide can leave the server offering only ciphers Chrome removed, so the handshake ends with no shared suite.
Replace the directive with the current Mozilla intermediate list and set ssl_protocols TLSv1.2 TLSv1.3, then reload. Avoid pinning a single cipher — it breaks on the next browser release.
Nginx has its own failure mode, but ERR_SSL_VERSION_OR_CIPHER_MISMATCH has a wider set of causes. The most common one overall is: The server only supports TLS 1.0 or 1.1.
Enable TLS 1.2 and 1.3. On nginx: `ssl_protocols TLSv1.2 TLSv1.3;` then reload.
The SSL check enumerates exactly which protocol versions and suites the server accepts, turning guesswork into a list.
An ssl_ciphers line copied from an old hardening guide can leave the server offering only ciphers Chrome removed, so the handshake ends with no shared suite.
Replace the directive with the current Mozilla intermediate list and set ssl_protocols TLSv1.2 TLSv1.3, then reload. Avoid pinning a single cipher — it breaks on the next browser release.
The browser and server have no protocol version or cipher suite in common, so the handshake ends before it starts. Almost always an origin still pinned to TLS 1.0/1.1 or an ancient cipher list.