<!-- https://pkizerotohero.com/errors/chrome-err-ssl-version-or-cipher-mismatch/ | Markdown mirror of the HTML page | PKI Zero to Hero, by Duyutech BV -->

> Fix ERR_SSL_VERSION_OR_CIPHER_MISMATCH: test which TLS versions and ciphers the server offers, then enable TLS 1.2 and 1.3 with modern ciphers.

Source: https://pkizerotohero.com/errors/chrome-err-ssl-version-or-cipher-mismatch/ · Last reviewed: 2026-10-20

- Chrome
- Exact text checked with the real tool

# ERR\_SSL\_VERSION\_OR\_CIPHER\_MISMATCH

Also seen in: Edge, Brave, Opera, Electron apps, Android WebView

**In one sentence:**

Browser and server share no TLS version or cipher suite: usually the server speaks only TLS 1.0 or 1.1, offers outdated ciphers, or lacks a certificate for the name.

[Check yours: Paste your error](https://pkizerotohero.com/tools/error-finder/)

## Where you see it

As a grey error page in Chrome, Edge and other Chromium browsers. The code is `ERR_SSL_VERSION_OR_CIPHER_MISMATCH` (−113) in Chromium’s [network error list](https://source.chromium.org/chromium/chromium/src/+/main:net/base/net_error_list.h), described there as “The client and server don’t support a common SSL protocol version or cipher suite”.

```text
This site can’t provide a secure connection
www.example.com uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH
```

Under **Details**, Chrome adds “Unsupported protocol” and “The client and server don’t support a common SSL protocol version or cipher suite.” Edge shows the same code under “The connection for this site is not secure”. Firefox reports the same situations as `SSL_ERROR_PROTOCOL_VERSION_ALERT` or `SSL_ERROR_UNSUPPORTED_VERSION` (both with “This website might not support the TLS 1.2 protocol, which is the minimum version supported by Firefox.”) or `SSL_ERROR_NO_CYPHER_OVERLAP`.

## What it means

In the first message of the [TLS handshake](https://pkizerotohero.com/handbook/glossary/#tls-handshake), the browser lists the TLS versions and [cipher suites](https://pkizerotohero.com/handbook/glossary/#cipher-suite) it accepts. The server must pick one of each. Here the server found nothing it could pick, or refused the browser’s offer outright, so no secure connection was possible. Chromium maps a `protocol_version` alert, and a `handshake_failure` alert sent straight after the browser’s first message, to this code ([openssl\_ssl\_util.cc](https://source.chromium.org/chromium/chromium/src/+/main:net/ssl/openssl_ssl_util.cc)). Current browsers accept only TLS 1.2 and TLS 1.3: RFC 8996 formally deprecated TLS 1.0 and 1.1 in March 2021.

Note

If you are just visiting a website

Update your browser first. If the error stays, the site runs outdated or broken TLS settings, and only its owner can fix it. Old devices such as printers, routers and server management boards often show this on their admin pages.

## Likely causes

### The server only speaks TLS 1.0 or 1.1

Common on old appliances, old management interfaces and servers that were never updated. **Confirm** by asking for TLS 1.2 only:

```bash
openssl s_client -connect www.example.com:443 -servername www.example.com -tls1_2 </dev/null
```

```text
40C7972B8B7E0000:error:0A000102:SSL routines:ssl_choose_client_version:unsupported protocol:../ssl/statem/statem_lib.c:1981:
```

A server that refuses with an alert gives `tlsv1 alert protocol version` instead. A healthy server shows `New, TLSv1.3, Cipher is …` or `New, TLSv1.2, Cipher is …`.

**Fix:** enable TLS 1.2 and TLS 1.3 on the server. In nginx:

```text
ssl_protocols TLSv1.2 TLSv1.3;
```

For an appliance, install the vendor’s firmware update; if there is none, put a modern reverse proxy in front of it or replace it. Do not ask users to re-enable old protocols in their browsers.

### The server offers no cipher suite the browser accepts

The server may be limited to old or unusual cipher suites, for example after someone copied an outdated cipher list, or on old Java or Windows servers. **Confirm:** with no shared cipher, the server sends a `handshake_failure` alert:

```bash
openssl s_client -connect www.example.com:443 -servername www.example.com -tls1_2 </dev/null
```

```text
40E7B3BAB87D0000:error:0A000410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:../ssl/record/rec_layer_s3.c:1599:SSL alert number 40
```

OpenSSL 3.2 and later print `ssl/tls alert handshake failure` for the same alert.

**Fix:** use your server’s current recommended defaults or a well-known modern profile: ECDHE key exchange with AES-GCM or ChaCha20-Poly1305 for TLS 1.2, and TLS 1.3, which has its own fixed set. See [How to configure TLS securely](https://pkizerotohero.com/guides/tls-configuration/).

### The server or CDN has no certificate for this name

A server that hosts many names chooses the certificate from the name the browser sends ([SNI](https://pkizerotohero.com/handbook/glossary/#sni)). Some servers and CDNs abort the handshake when they have no certificate for that name, and the browser shows this error rather than a certificate error. Cloudflare, for example, [documents this error](https://developers.cloudflare.com/ssl/troubleshooting/version-cipher-mismatch/) for names its certificate does not cover, such as a second-level subdomain like `test.dev.example.com`, or a certificate that is not active yet.

**Confirm** by comparing the name you visit with what the server offers:

```bash
openssl s_client -connect www.example.com:443 -servername www.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName
```

**Fix:** add the name to a certificate on that server or CDN, or order one that covers it, then wait until it is active.

## Check yours

*Interactive tool: Paste your error (runs in the browser at [/tools/error-finder/](https://pkizerotohero.com/tools/error-finder/))*

Paste the error, or the last lines of the `openssl s_client` output. The finder points you to the matching page; the `openssl` commands above show which TLS versions the server accepts.

## Learn why

- [The TLS 1.3 handshake](https://pkizerotohero.com/handbook/tls-handshake/): how the client and server agree on a version and a cipher suite.
- Related: [ERR\_SSL\_PROTOCOL\_ERROR](https://pkizerotohero.com/errors/chrome-err-ssl-protocol-error/), [curl: (35)](https://pkizerotohero.com/errors/curl-35-ssl-connect-error/) and Java’s [handshake\_failure](https://pkizerotohero.com/errors/java-handshake-failure/).
- The standard: [RFC 8996](https://www.rfc-editor.org/rfc/rfc8996), which deprecates TLS 1.0 and 1.1.

**Early edition.** Checked against the standards; an independent expert review is in progress. Found a mistake? [Tell us](https://pkizerotohero.com/contact/?topic=content-error&page=/errors/chrome-err-ssl-version-or-cipher-mismatch/).

Last reviewed 20 October 2026Edition 0.9

## Learn why it happens

- [Chapter 15: The TLS 1.3 handshake](https://pkizerotohero.com/handbook/tls-handshake/)

## Fix it step by step

- [How to configure TLS securely (versions, ciphers, HSTS)](https://pkizerotohero.com/guides/tls-configuration/)

## Everything on this topic

- [TLS and HTTPS](https://pkizerotohero.com/topics/tls/)