net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Shown as "ERR_SSL_VERSION_OR_CIPHER_MISMATCH" on the error page and "net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH" in automation tools. In our tests a TLS 1.0-only server and a server with only an RSA-key-exchange CAMELLIA suite both produced it.

Chrome, Edge and other Chromium browsers — "This site can't provide a secure connection … uses an unsupported protocol"

What it means

Chrome and the server have no TLS version or cipher suite in common, so no handshake is possible. Chrome supports only TLS 1.2 and 1.3 with modern suites; servers limited to TLS 1.0/1.1, RC4, 3DES or other legacy configurations are refused. The page says the site "uses an unsupported protocol".

Why it happens

• The server only supports TLS 1.0 or 1.1

  common

  Chrome removed TLS 1.0/1.1 in 2020; old appliances, printers, NAS boxes and unmaintained servers still offer nothing newer.

• No supported cipher suite

  common

  Servers that only allow RC4, 3DES or exotic suites (CAMELLIA, SEED) with RSA key exchange have nothing Chrome will use.

• The edge has no certificate for the requested name

  occasional

  Some CDNs and load balancers abort the handshake when a custom domain has no certificate provisioned yet.

How to fix it

1. 1.

   Find out what the server offers

   If TLS 1.2 with an ECDHE suite fails, the server needs updating.

   nmap --script ssl-enum-ciphers -p 443 legacy.example.com   # versions and suites offered
   echo | openssl s_client -connect legacy.example.com:443 -servername legacy.example.com -tls1_2 -brief

2. 2.

   Site owners: enable TLS 1.2/1.3 with modern suites

   Current suites work with every browser released in the last decade.

   # nginx
   ssl_protocols TLSv1.2 TLSv1.3;
   ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;

3. 3.

   CDN-hosted sites: check the domain's certificate status

   Make sure the domain is attached and its certificate issued before pointing DNS at the edge.

   CDN / hosting: check that the custom domain is attached and has an active certificate;
   some edges refuse the handshake for names without a certificate.

← Browse the full signature error database