What causes ERR_SSL_PROTOCOL_ERROR in Chrome?

This error means Chrome cannot establish a secure TLS connection. Common causes: the server only supports deprecated TLS 1.0/1.1 or SSLv3 (all disabled in modern Chrome), a misconfigured or self-signed certificate, a stale HSTS entry in Chrome's cache, or a network proxy or antivirus performing SSL inspection with an untrusted certificate.

How do I fix ERR_SSL_PROTOCOL_ERROR?

First verify the certificate is valid and not expired using an SSL checker. Check the server supports TLS 1.2 or 1.3. Clear Chrome's SSL cache: Settings → Privacy and Security → Clear browsing data. For HSTS cache issues, visit chrome://net-internals/#hsts, enter the domain, and click Delete. If a proxy is involved, check SSL inspection settings.

Can a firewall or antivirus cause ERR_SSL_PROTOCOL_ERROR?

Yes. SSL/TLS inspection software intercepts TLS connections and re-encrypts with its own certificate. If that certificate uses an outdated protocol, is untrusted, or uses weak ciphers, Chrome shows a protocol error. Temporarily disabling SSL inspection in your security software can confirm this is the cause.

Does ERR_SSL_PROTOCOL_ERROR mean my site is hacked?

Almost never. This error is almost always a configuration issue — outdated TLS settings, expired certificate, or browser cache corruption — not a security breach. However, if the error appears suddenly on a previously working site, verify your certificate hasn't been replaced unexpectedly and check that DNS records haven't changed.

Back to Learning Center

Error Fix

How to Fix ERR_SSL_PROTOCOL_ERROR

6 min read·Updated June 2026·By CertNotify Team

ERR_SSL_PROTOCOL_ERROR appears in Chrome and Chromium-based browsers when the TLS handshake fails. It means the browser and server could not agree on a secure connection — either due to a server misconfiguration, an expired/invalid certificate, or a client-side issue.

Important — this error prevents users from accessing your site. If you see it on your own domain, treat it as a P1 incident — resolve it immediately to avoid traffic loss.

Most Common Causes

Expired SSL certificate: The most common cause. Browsers reject connections to servers with expired certificates.

TLS version mismatch: Your server only supports TLS 1.0/1.1 (deprecated) while modern browsers require TLS 1.2+.

Self-signed certificate: Certificates not issued by a trusted CA are rejected by default.

Incomplete certificate chain: Missing intermediate certificates cause the browser to fail chain validation.

Wrong domain on certificate: Certificate covers a different domain than the one being accessed (CN/SAN mismatch).

Firewall or antivirus SSL inspection: Security software intercepting TLS traffic can cause protocol errors.

Step 1 — Diagnose the Certificate

Use OpenSSL to check what certificate your server is presenting:

echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates -subject -issuer

Check: notAfter is in the future, subject matches your domain, and issuer is a trusted CA.

Step 2 — Check TLS Version Support

Test which TLS versions your server supports:

# Test TLS 1.2
openssl s_client -connect yourdomain.com:443 -tls1_2 2>&1 | grep "Protocol"

# Test TLS 1.3
openssl s_client -connect yourdomain.com:443 -tls1_3 2>&1 | grep "Protocol"

If TLS 1.2 and 1.3 both fail, your server configuration is the issue. Update your web server config:

# Nginx

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;

# Apache

SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite TLSv1.3 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256

Step 3 — Fix the Certificate Chain

An incomplete chain means your server isn't sending intermediate certificates. Build the full chain:

# Combine your certificate + intermediate CA(s) into one file
cat your_domain.crt intermediate.crt root.crt > fullchain.pem

In Nginx, point ssl_certificate to fullchain.pem. Let's Encrypt includes this by default.

Client-Side Fixes (Visitor's Browser)

Clear browser cache and cookies (Chrome: Settings → Privacy → Clear browsing data)

Disable browser extensions temporarily — especially VPN and security extensions

Check system date and time — an incorrect clock causes certificate validation failures

Disable antivirus SSL inspection temporarily to test if it's the cause

Try incognito mode or a different browser to isolate the issue

Use our free SSL Certificate Checker to diagnose certificate and TLS issues on any domain — including expired certificates, weak TLS versions, and chain errors.