---
title: "ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Nginx: cause and fix"
description: "An ssl_ciphers line copied from an old hardening guide can leave the server offering only ciphers Chrome removed, so the handshake ends with no shared suite."
canonical: "https://lemwatch.com/errors/err-ssl-version-or-cipher-mismatch/in-nginx"
source: "https://lemwatch.com"
---

# ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Nginx

> An ssl_ciphers line copied from an old hardening guide can leave the server offering only ciphers Chrome removed, so the handshake ends with no shared suite.

## Why it happens on Nginx

 An ssl_ciphers line copied from an old hardening guide can leave the server offering only ciphers Chrome removed, so the handshake ends with no shared suite.

## The fix on Nginx

 Replace the directive with the current Mozilla intermediate list and set ssl_protocols TLSv1.2 TLSv1.3, then reload. Avoid pinning a single cipher — it breaks on the next browser release.

## If that didn't fix it

 Nginx has its own failure mode, but ERR_SSL_VERSION_OR_CIPHER_MISMATCH has a wider set of causes. The most common one overall is: The server only supports TLS 1.0 or 1.1.

 Enable TLS 1.2 and 1.3. On nginx: `ssl_protocols TLSv1.2 TLSv1.3;` then reload.

## Check your own domain

 The SSL check enumerates exactly which protocol versions and suites the server accepts, turning guesswork into a list.

## Frequently asked questions

### Why does ERR_SSL_VERSION_OR_CIPHER_MISMATCH happen on Nginx?

 An ssl_ciphers line copied from an old hardening guide can leave the server offering only ciphers Chrome removed, so the handshake ends with no shared suite.

### How do I fix ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Nginx?

 Replace the directive with the current Mozilla intermediate list and set ssl_protocols TLSv1.2 TLSv1.3, then reload. Avoid pinning a single cipher — it breaks on the next browser release.

### What does ERR_SSL_VERSION_OR_CIPHER_MISMATCH mean?

 The browser and server have no protocol version or cipher suite in common, so the handshake ends before it starts. Almost always an origin still pinned to TLS 1.0/1.1 or an ancient cipher list.


## Related

- [All causes of ERR_SSL_VERSION_OR_CIPHER_MISMATCH](https://lemwatch.com/errors/err-ssl-version-or-cipher-mismatch)
- [All website error codes](https://lemwatch.com/errors)
- [ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Cloudflare](https://lemwatch.com/errors/err-ssl-version-or-cipher-mismatch/in-cloudflare)
- [ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Chrome](https://lemwatch.com/errors/err-ssl-version-or-cipher-mismatch/on-chrome)
- [Free SSL certificate check](https://lemwatch.com/tools/ssl-checker)
- [Lemwatch pricing](https://lemwatch.com/pricing)