net::ERR_SSL_PROTOCOL_ERROR

Shown as "ERR_SSL_PROTOCOL_ERROR" on the error page and as "net::ERR_SSL_PROTOCOL_ERROR" in automation tools and DevTools.

Chrome, Edge and other Chromium browsers — "This site can't provide a secure connection"

What it means

Chrome could not complete a TLS handshake because the server's reply violated the protocol: most often it was not TLS at all (a plain-HTTP server on that port), or the server sent malformed or unexpected handshake data. The page shows "This site can't provide a secure connection — <host> sent an invalid response". Certificates are not involved.

Why it happens

• https:// to a port that serves plain HTTP

  common

  Development servers, admin ports or a server whose TLS listener is missing.

• HSTS forces https:// for a plain-HTTP development site

  common

  Domains on the HSTS preload list (such as .dev and .app) or hosts that sent Strict-Transport-Security before are always upgraded to https://, even when the local server only speaks HTTP.

• A misconfigured or broken TLS server

  occasional

  Proxies with a wrong backend protocol, buggy appliances, or a server that closes the connection mid-handshake.

• Antivirus or firewall interference

  occasional

  HTTPS-scanning features and network filters that break the handshake produce the same error on otherwise healthy sites.

How to fix it

1. 1.

   Check what the port speaks

   If plain HTTP answers, use the TLS port or enable TLS on that listener.

   curl -si http://www.example.com:8080/ | head -1              # plain HTTP answers?
   openssl s_client -connect www.example.com:443 -servername www.example.com -brief </dev/null

2. 2.

   Development: clear HSTS or use local HTTPS

   Delete the host's HSTS entry in chrome://net-internals/#hsts (not possible for preloaded domains) or give the dev server a locally trusted certificate.

   Local development on a domain with HSTS (e.g. *.dev, or a site you once visited over HTTPS):
   open chrome://net-internals/#hsts, "Delete domain security policies" for the host,
   or serve the dev site over HTTPS with a locally trusted certificate (mkcert).

3. 3.

   Site owners: enable TLS where https:// is served

   Configure the listener with TLS and a certificate, and test the handshake from outside.

   Site owners: make sure the port that browsers reach with https:// has TLS enabled
   (nginx: "listen 443 ssl;" plus ssl_certificate / ssl_certificate_key).

← Browse the full signature error database