Error Fix

How to Fix ERR_SSL_PROTOCOL_ERROR

6 min read·Updated June 2026·By CertNotify Team

ERR_SSL_PROTOCOL_ERROR appears in Chrome and Chromium-based browsers when the TLS handshake fails. It means the browser and server could not agree on a secure connection — either due to a server misconfiguration, an expired/invalid certificate, or a client-side issue.

Important — this error prevents users from accessing your site. If you see it on your own domain, treat it as a P1 incident — resolve it immediately to avoid traffic loss.

Most Common Causes

Expired SSL certificate: The most common cause. Browsers reject connections to servers with expired certificates.

TLS version mismatch: Your server only supports TLS 1.0/1.1 (deprecated) while modern browsers require TLS 1.2+.

Self-signed certificate: Certificates not issued by a trusted CA are rejected by default.

Incomplete certificate chain: Missing intermediate certificates cause the browser to fail chain validation.

Wrong domain on certificate: Certificate covers a different domain than the one being accessed (CN/SAN mismatch).

Firewall or antivirus SSL inspection: Security software intercepting TLS traffic can cause protocol errors.

Step 1 — Diagnose the Certificate

Use OpenSSL to check what certificate your server is presenting:

echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates -subject -issuer

Check: notAfter is in the future, subject matches your domain, and issuer is a trusted CA.

Step 2 — Check TLS Version Support

Test which TLS versions your server supports:

# Test TLS 1.2
openssl s_client -connect yourdomain.com:443 -tls1_2 2>&1 | grep "Protocol"

# Test TLS 1.3
openssl s_client -connect yourdomain.com:443 -tls1_3 2>&1 | grep "Protocol"

If TLS 1.2 and 1.3 both fail, your server configuration is the issue. Update your web server config:

# Nginx

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;

# Apache

SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite TLSv1.3 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256

Step 3 — Fix the Certificate Chain

An incomplete chain means your server isn't sending intermediate certificates. Build the full chain:

# Combine your certificate + intermediate CA(s) into one file
cat your_domain.crt intermediate.crt root.crt > fullchain.pem

In Nginx, point ssl_certificate to fullchain.pem. Let's Encrypt includes this by default.

Client-Side Fixes (Visitor's Browser)

Clear browser cache and cookies (Chrome: Settings → Privacy → Clear browsing data)

Disable browser extensions temporarily — especially VPN and security extensions

Check system date and time — an incorrect clock causes certificate validation failures

Disable antivirus SSL inspection temporarily to test if it's the cause

Try incognito mode or a different browser to isolate the issue

Use our free SSL Certificate Checker to see whether a domain's certificate has expired and which TLS version it negotiates, and the Certificate Chain Checker to find a missing or expired intermediate.

Common questions

What causes ERR_SSL_PROTOCOL_ERROR in Chrome?

This error means Chrome cannot establish a secure TLS connection. Common causes: the server only supports deprecated TLS 1.0/1.1 or SSLv3 (all disabled in modern Chrome), a misconfigured or self-signed certificate, a stale HSTS entry in Chrome's cache, or a network proxy or antivirus performing SSL inspection with an untrusted certificate.

How do I fix ERR_SSL_PROTOCOL_ERROR?

First verify the certificate is valid and not expired using an SSL checker. Check the server supports TLS 1.2 or 1.3. Clear Chrome's SSL cache: Settings → Privacy and Security → Clear browsing data. For HSTS cache issues, visit chrome://net-internals/#hsts, enter the domain, and click Delete. If a proxy is involved, check SSL inspection settings.

Can a firewall or antivirus cause ERR_SSL_PROTOCOL_ERROR?

Yes. SSL/TLS inspection software intercepts TLS connections and re-encrypts with its own certificate. If that certificate uses an outdated protocol, is untrusted, or uses weak ciphers, Chrome shows a protocol error. Temporarily disabling SSL inspection in your security software can confirm this is the cause.

Does ERR_SSL_PROTOCOL_ERROR mean my site is hacked?

Almost never. This error is almost always a configuration issue — outdated TLS settings, expired certificate, or browser cache corruption — not a security breach. However, if the error appears suddenly on a previously working site, verify your certificate hasn't been replaced unexpectedly and check that DNS records haven't changed.

References and further reading

The specifications and primary documentation this article is based on.