View Plans
Help

How to fix ERR_SSL_PROTOCOL_ERROR

ERR_SSL_PROTOCOL_ERROR means your browser and the website’s server could not agree on a secure (TLS) connection, so the page did not load. On your side, check the date and time, extensions, VPN and network. If it is your website, check its SSL certificate, DNS, TLS settings, CDN and firewall.

Updated · HostUpIndia team

What ERR_SSL_PROTOCOL_ERROR means

Before a page loads over https, the browser and the server agree on a secure (TLS) connection. When that handshake fails, Chrome shows “This site can’t provide a secure connection” and “example.com sent an invalid response”, with the code ERR_SSL_PROTOCOL_ERROR. Edge shows the same code.

Firefox shows “Secure Connection Failed” with its own code, such as SSL_ERROR_RX_RECORD_TOO_LONG or PR_END_OF_FILE_ERROR. Safari says it can’t establish a secure connection to the server.

A warning such as NET::ERR_CERT_DATE_INVALID or NET::ERR_CERT_COMMON_NAME_INVALID is a certificate problem instead. See how to fix “Your connection is not private”.

  • A wrong date or time on your device.
  • A browser extension, antivirus, VPN or network that interferes with secure connections.
  • An outdated browser or operating system.
  • A server with no HTTPS set up for the site, or one that does not answer in TLS on port 443.
  • A CDN, proxy or firewall in front of the site that is set up wrong.

If you are visiting the site

Start on your own device. If the site works on another device or network, the problem is on yours.

  • Set your device’s date, time and time zone to update automatically, then reload the page.
  • Open the site in a private (incognito) window, where most extensions are off. If it loads, turn off your extensions one at a time to find the one at fault.
  • Clear your browser’s cached images and files, then reload.
  • Pause your VPN or proxy, and any HTTPS scanning in your antivirus, then reload. If the page loads, update that app or add the site as an exception, then turn them back on.
  • Update your browser and your operating system.
  • Try another network, such as mobile data. Some office, school and public Wi-Fi networks block or inspect secure connections.
  • If the site fails on every device and network, tell its owner. The fix is on their side.

If it is your website: test the connection

First confirm the error happens for everyone, then see what the server sends on port 443.

  • Open the site on mobile data, in a private window and on another device.
  • Run curl -vI https://example.com in a terminal, with your own domain. The output shows the TLS handshake and where it stops.
  • Run openssl s_client -connect example.com:443 -servername example.com. An error such as “wrong version number” means port 443 answers in plain http, not TLS. Firefox’s SSL_ERROR_RX_RECORD_TOO_LONG points to the same thing.
  • Check the domain with an online SSL checker. It lists the certificate, the names it covers and the TLS versions the server offers.
  • If the error began after a change, such as a move to new hosting, a DNS edit or a new CDN, start your checks there.
  • Seeing it on localhost? Your local server likely serves plain http. Open the address with http:// and its port, such as http://localhost:8000.

Fix the SSL certificate and DNS

The domain must point to the server that holds its certificate, and the certificate must cover the exact name visitors use, with and without www.

  • Before you change DNS, copy down the current records.
  • Check that the domain’s A record points to your hosting IP address, shown in your welcome email or client area. Run dig example.com A to see it.
  • Check for an AAAA (IPv6) record with dig example.com AAAA. If it points anywhere other than your hosting, correct or remove it.
  • Check the www name the same way.
  • In cPanel, open SSL/TLS Status and check that the domain and its www name have a valid certificate.
  • If they do not, select Run AutoSSL, where your host offers it. AutoSSL can only issue a certificate once the domain points to your hosting.
  • If you installed a certificate yourself, open SSL/TLS › Manage SSL sites and check that it has not expired, and that the certificate, private key and CA bundle belong together.
  • Allow a few hours for DNS changes to reach every network, then test again on mobile data.

Fix TLS, the CDN and the firewall

Current browsers need TLS 1.2 or 1.3 and refuse the old TLS 1.0 and 1.1 by default. Anything in front of your server, such as a CDN or firewall, has its own secure connection to get right. Chrome reports a server that offers only TLS 1.0 or 1.1 as ERR_SSL_VERSION_OR_CIPHER_MISMATCH; the fix below is the same.

  • On shared hosting, the host manages TLS. If an SSL checker shows only TLS 1.0 or 1.1, or no TLS on port 443, open a support ticket.
  • On your own server, back up the web server’s configuration first.
  • Then make sure port 443 is set up for SSL, with TLS 1.2 and 1.3 turned on, and reload the web server.
  • Test again with the openssl s_client command above.
  • Behind Cloudflare, open SSL/TLS › Edge Certificates and check that the certificate is Active and covers the exact name. The free Universal SSL certificate covers example.com and *.example.com, not deeper names such as shop.eu.example.com.
  • Set Cloudflare’s SSL/TLS encryption mode to Full (strict) once the server has a valid certificate. Flexible reaches your server over http, which can loop with an https redirect: see how to fix “too many redirects”.
  • With another CDN or proxy, check that it has a valid certificate for your domain and connects to your server over https.
  • If a firewall, WAF or load balancer sits in front of the server, check that it allows port 443 and either passes TLS through or holds a valid certificate itself.
  • Keep a valid certificate in place if the site sends a Strict-Transport-Security (HSTS) header. Browsers that have seen it use only https until it expires, and cannot fall back to http.

HostUpIndia Web & cPanel Hosting

HostUpIndia Web & cPanel plans include free SSL and cPanel, where SSL/TLS Status shows each certificate. They run on LiteSpeed with NVMe storage, terminal (SSH) access, the AI Website Builder and daily backups kept 30 days.

From ₹49 a month on 3-year billing. Prices exclude 18% GST. See Web & cPanel plans.

  • Support tickets and email are received 24 hours a day, 7 days a week; WhatsApp is open for questions from 10 am to 7 pm IST, Monday to Saturday.
  • Free website migration by the HostUpIndia in-house team.
  • More help guides.