Webhook Relay

ERR_SSL_VERSION_OR_CIPHER_MISMATCH: what it means and how to fix it

ERR_SSL_VERSION_OR_CIPHER_MISMATCH means the browser and the server share no TLS protocol version or cipher suite, so the secure connection can't be set up. Modern browsers only speak TLS 1.2 and 1.3 with strong ciphers. A server that offers only TLS 1.0/1.1, only obsolete ciphers, or no usable certificate for the hostname triggers this error.

This site can't provide a secure connection
example.com uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH

In DevTools it appears as net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH. Firefox shows SSL_ERROR_UNSUPPORTED_VERSION or SSL_ERROR_NO_CYPHER_OVERLAP, and command-line clients print errors like:

curl: (35) error:0A000102:SSL routines::unsupported protocol
error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version
javax.net.ssl.SSLHandshakeException: Received fatal alert: protocol_version

Common causes

  • The server only supports TLS 1.0 or 1.1. Chrome, Edge, Firefox and Safari have all removed them. Old appliances, embedded web UIs, legacy IIS and old Java servers are typical.
  • Only obsolete ciphers are enabled. RC4, 3DES or export-grade suites that browsers no longer offer.
  • No certificate for that hostname. The server has no certificate matching the SNI name, or the certificate uses a key type the server's TLS configuration can't use.
  • Cloudflare edge certificate not ready. Universal SSL hasn't been issued yet for a new domain, or the hostname is a second-level subdomain (a.b.example.com) that Universal SSL doesn't cover.
  • Something in the middle. Antivirus HTTPS scanning or an outdated corporate proxy that re-negotiates TLS with old settings.

How to fix it as a visitor

  1. Update your browser and operating system.
  2. Try another browser or network to see whether it's your device or the site.
  3. Turn off antivirus HTTPS or "web shield" scanning briefly to test.
  4. If the site is old or internal, contact its owner. Current Chrome has no setting to re-enable TLS 1.0/1.1, and doing so wouldn't be safe.

How to fix it as a developer or ops

Enable modern TLS. For nginx:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
# Cipher list: use Mozilla's "intermediate" configuration for your server version.

On Apache use SSLProtocol -all +TLSv1.2 +TLSv1.3. On Windows/IIS, enable TLS 1.2 in the registry or with a tool like IIS Crypto, and on old Java runtimes upgrade the JDK.

Test what the server offers:

openssl s_client -connect example.com:443 -servername example.com -tls1_2
openssl s_client -connect example.com:443 -servername example.com -tls1_3
nmap --script ssl-enum-ciphers -p 443 example.com

If both openssl commands fail, the server has no modern protocol enabled. An online checker such as SSL Labs gives the same picture with a grade.

Check the certificate binding. Confirm the hostname has a certificate in the server block or virtual host that actually answers for it, and that requests with SNI reach it.

On Cloudflare, open SSL/TLS > Edge Certificates and check that a certificate covers the hostname and is active. For deeper subdomains, add an advanced certificate or flatten the hostname.

On a webhook endpoint

The same mismatch happens between machines, and there's no browser message to see. A legacy sender (an old ERP, an on-prem appliance, an IoT controller) that can only do TLS 1.0/1.1 tries to post a webhook to a modern endpoint, and the handshake fails with unsupported protocol or protocol_version. The event never arrives.

The usual workaround is lowering TLS on the receiving server, which weakens every connection to it for one old client. A better option is to give the legacy sender its own Webhook Relay input with TLS compatibility:

  • Minimum TLS version per input. The default is TLS 1.3; lower it to TLS 1.2 for senders that need it (Business and Pro).
  • Legacy TLS compatibility accepts TLS versions down to 1.0 and a wider legacy cipher set on that one input (Pro).

Webhook Relay completes the old handshake on that input and forwards the event onward over modern TLS. Every other input stays on TLS 1.3. The TLS/SSL error reference lists the exact error strings for curl, OpenSSL, Python, Node.js, Java and Go.

If the browser complains about who signed the certificate rather than about protocols, that's a different error: see ERR_CERT_AUTHORITY_INVALID.

Frequently asked questions

What does ERR_SSL_VERSION_OR_CIPHER_MISMATCH mean?

It means Chrome or Edge and the web server couldn't agree on a TLS protocol version or a cipher suite, so the secure connection was never set up. The browser shows This site can't provide a secure connection, and the site uses an unsupported protocol. The server is usually too old or misconfigured.

How do I fix ERR_SSL_VERSION_OR_CIPHER_MISMATCH as a visitor?

There's usually little you can do, because the server's TLS setup is the problem. Make sure your browser and operating system are up to date, try another browser or network, and turn off antivirus HTTPS scanning to test. Re-enabling old TLS versions in your browser isn't possible in current Chrome and isn't safe.

How do I fix ERR_SSL_VERSION_OR_CIPHER_MISMATCH on my server?

Enable TLS 1.2 and TLS 1.3 with modern cipher suites. In nginx set ssl_protocols TLSv1.2 TLSv1.3 and use a current cipher list such as Mozilla's intermediate configuration. Make sure a valid certificate is configured for the exact hostname. Then test with openssl s_client or an online SSL checker.

Why do I get ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Cloudflare?

Usually because Cloudflare has no edge certificate for that hostname yet. Universal SSL can take a while to issue for a new domain, and it only covers the apex and first-level subdomains, so a hostname like a.b.example.com needs an advanced or custom certificate. It can also happen if the hostname isn't proxied correctly.

Can a legacy system that only supports TLS 1.0 still send webhooks?

Not to a modern endpoint that has disabled TLS 1.0, which is most of them. The options are upgrading the system, or sending its webhooks to a relay input that accepts TLS 1.0 and forwards the events over modern TLS, as Webhook Relay's legacy TLS compatibility does on the Pro plan.

Related