ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Nginx

An ssl_ciphers line copied from an old hardening guide can leave the server offering only ciphers Chrome removed, so the handshake ends with no shared suite.

Why it happens on Nginx

An ssl_ciphers line copied from an old hardening guide can leave the server offering only ciphers Chrome removed, so the handshake ends with no shared suite.

The fix on Nginx

Replace the directive with the current Mozilla intermediate list and set ssl_protocols TLSv1.2 TLSv1.3, then reload. Avoid pinning a single cipher — it breaks on the next browser release.

If that didn't fix it

Nginx has its own failure mode, but ERR_SSL_VERSION_OR_CIPHER_MISMATCH has a wider set of causes. The most common one overall is: The server only supports TLS 1.0 or 1.1.

Enable TLS 1.2 and 1.3. On nginx: `ssl_protocols TLSv1.2 TLSv1.3;` then reload.

Check your own domain

The SSL check enumerates exactly which protocol versions and suites the server accepts, turning guesswork into a list.

Frequently asked questions

Why does ERR_SSL_VERSION_OR_CIPHER_MISMATCH happen on Nginx?

An ssl_ciphers line copied from an old hardening guide can leave the server offering only ciphers Chrome removed, so the handshake ends with no shared suite.

How do I fix ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Nginx?

Replace the directive with the current Mozilla intermediate list and set ssl_protocols TLSv1.2 TLSv1.3, then reload. Avoid pinning a single cipher — it breaks on the next browser release.

What does ERR_SSL_VERSION_OR_CIPHER_MISMATCH mean?

The browser and server have no protocol version or cipher suite in common, so the handshake ends before it starts. Almost always an origin still pinned to TLS 1.0/1.1 or an ancient cipher list.