---
title: "SSL handshake failed: causes and how to fix it"
description: "A generic handshake failure reported by servers, CDNs and API clients rather than browsers. The connection reached the server but the TLS negotiation aborted…"
canonical: "https://lemwatch.com/errors/ssl-handshake-failed"
source: "https://lemwatch.com"
---

# SSL handshake failed: The TLS handshake did not complete

> A generic handshake failure reported by servers, CDNs and API clients rather than browsers. The connection reached the server but the TLS negotiation aborted — protocol mismatch, certificate rejection, or a required client certificate.

## Short answer

 A generic handshake failure reported by servers, CDNs and API clients rather than browsers. The connection reached the server but the TLS negotiation aborted — protocol mismatch, certificate rejection, or a required client certificate.

## What SSL handshake failed means

 The phrase appears in nginx logs, Cloudflare 525 pages, curl output and API SDKs. It always means the same thing: TCP connected, TLS did not. The useful detail is in whichever side logged it.

## Causes and fixes, most likely first

- No shared protocol or cipher between the two sides. Compare the versions each side supports. Enable TLS 1.2/1.3 on the origin.
- The server requires a client certificate that was not presented. Present the client certificate, or turn off mutual TLS for that route if it was enabled unintentionally.
- SNI is missing, so the server selects a default certificate that does not match. Ensure the client sends SNI. Very old clients and some scripted requests omit it.

## How to stop it happening again

- Log the TLS version and cipher on the origin so handshake failures can be attributed rather than guessed.

## Check your own domain

 An external handshake attempt reproduces the failure from outside your network and reports the exact stage it aborted at.

## Frequently asked questions

### What is the difference between a handshake failure and a certificate error?

 A certificate error means the handshake completed far enough for the browser to inspect and reject the certificate. A handshake failure means negotiation aborted before that point.


## Related

- [All website error codes](https://lemwatch.com/errors)
- [ERR_SSL_PROTOCOL_ERROR](https://lemwatch.com/errors/err-ssl-protocol-error)
- [ERR_SSL_VERSION_OR_CIPHER_MISMATCH](https://lemwatch.com/errors/err-ssl-version-or-cipher-mismatch)
- [Cloudflare Error 525](https://lemwatch.com/errors/cloudflare-525)
- [Free SSL certificate check](https://lemwatch.com/tools/ssl-checker)
- [White screen of death: A blank page with no error](https://lemwatch.com/errors/white-screen-of-death)
- [Server DNS address could not be found: Chrome's plain-English DNS failure message](https://lemwatch.com/errors/server-dns-address-could-not-be-found)
- [All monitoring checks](https://lemwatch.com/features)