Fix ERR_SSL_PROTOCOL_ERROR in the browser

ERR_SSL_PROTOCOL_ERROR is Chrome's message when a secure connection fails during the TLS handshake, before encrypted data can be exchanged. Firefox shows the related "Secure Connection Failed" and Safari reports that it could not establish a secure connection. Because the failure happens early, the answer is almost always a mismatch between what the client, server, and anything in between expect, rather than a single obvious bug.

What failed

The browser reached the server but the two sides could not complete the TLS handshake. The common causes group into four places:

• An invalid, expired, or mismatched certificate or an incomplete certificate chain.
• A protocol or cipher mismatch, or a server advertising versions the client cannot use.
• Conflicting redirects or a CDN and origin pulling in opposite directions.
• A network, proxy, or anti-virus that inspects or interferes with the handshake.

Because the cause can be on either side, diagnose in a logical order, cheap first.

Client-side checks first

These rule out your own browser and network before you touch the server, and they resolve a large share of the cases.

1. Confirm the device date and time are correct. A clock far off makes certificates look invalid.
2. Clear the site's cache and cookies, or try incognito, to rule out stale certificate data.
3. Test the same site in another browser or on a phone data connection. If it works there, the problem is on that device or network.
4. Temporarily disable anti-virus scan-on-connect, a VPN, or a corporate proxy and retest. These are the usual local culprits for a mid-handshake failure.

Server-side checks

If the error affects everyone and all networks, the server or CDN is responsible.

1. Verify the certificate with an external checker that reports chain, expiry, and SAN coverage. Ensure the intermediate certificate is served, because a missing intermediate is a classic cause.
2. Confirm the certificate matches the hostname and the zone behind the CDN, and that you are not serving an old certificate after a renewal.
3. Check whether the problem is protocol-specific per network: if only some visitors fail, HTTP/3 over UDP (QUIC) or TLS 1.3 may be blocked by a middlebox. Disabling HTTP/3 or TLS 1.3 temporarily confirms it.
4. Look for a redirect loop or an SSL mode conflict between a CDN and the origin, since origin redirects can clash with edge-level HTTPS settings.

Prevention

Keep the certificate chain and expiry valid, renew ahead of time, and avoid changing SSL mode and redirect rules together. See why the SSL handshake can fail for the detailed layers and how an SSL handshake works for the background. Certificate-focused guidance lives in SSL/TLS certificate errors.

The habit that prevents most of this class of error: always verify a certificate change from an external vantage point, not just from your own cached browser.