[{"data":1,"prerenderedAt":605},["ShallowReactive",2],{"content-query-JWillNPA4j":3},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"layout":10,"crumb":11,"summary":12,"group":13,"order":14,"updated":15,"cta":16,"related":24,"faq":41,"body":57,"_type":598,"_id":599,"_source":600,"_file":601,"_stem":602,"_extension":603,"sitemap":604},"/http-errors/err-ssl-version-or-cipher-mismatch","http-errors",false,"","ERR_SSL_VERSION_OR_CIPHER_MISMATCH: what it means and how to fix it","ERR_SSL_VERSION_OR_CIPHER_MISMATCH means browser and server share no TLS version or cipher. Causes (TLS 1.0/1.1, Cloudflare SSL) and fixes.","reference","ERR_SSL_VERSION_OR_CIPHER_MISMATCH","Browser and server have no TLS version or cipher in common.","TLS and certificate errors",901,"2026-10-28",{"eyebrow":17,"title":18,"text":19,"to":20,"label":21,"secondaryTo":22,"secondaryLabel":23},"Webhook Relay TLS Compatibility","Let one legacy sender through without weakening everything","When an old system can only send webhooks over TLS 1.0 or 1.1, give it a Webhook Relay input that accepts its TLS version. Webhook Relay completes the old handshake on that one input and forwards the event over modern TLS. Every other input stays on TLS 1.3.","/features/tls-compatibility/","See TLS compatibility","/docs/webhooks/tls-ssl-errors/","TLS error reference",[25,28,31,34,37,39],{"title":26,"to":27},"ERR_CERT_AUTHORITY_INVALID","/http-errors/err-cert-authority-invalid/",{"title":29,"to":30},"502 Bad Gateway","/http-errors/502-bad-gateway/",{"title":32,"to":33},"Webhook gateway","/glossary/webhook-gateway/",{"title":35,"to":36},"Reverse proxy","/glossary/reverse-proxy/",{"title":38,"to":22},"TLS/SSL handshake errors",{"title":40,"to":20},"TLS compatibility",[42,45,48,51,54],{"q":43,"a":44},"What does ERR_SSL_VERSION_OR_CIPHER_MISMATCH mean?","It means Chrome or Edge and the web server couldn't agree on a TLS protocol version or a cipher suite, so the secure connection was never set up. The browser shows This site can't provide a secure connection, and the site uses an unsupported protocol. The server is usually too old or misconfigured.",{"q":46,"a":47},"How do I fix ERR_SSL_VERSION_OR_CIPHER_MISMATCH as a visitor?","There's usually little you can do, because the server's TLS setup is the problem. Make sure your browser and operating system are up to date, try another browser or network, and turn off antivirus HTTPS scanning to test. Re-enabling old TLS versions in your browser isn't possible in current Chrome and isn't safe.",{"q":49,"a":50},"How do I fix ERR_SSL_VERSION_OR_CIPHER_MISMATCH on my server?","Enable TLS 1.2 and TLS 1.3 with modern cipher suites. In nginx set ssl_protocols TLSv1.2 TLSv1.3 and use a current cipher list such as Mozilla's intermediate configuration. Make sure a valid certificate is configured for the exact hostname. Then test with openssl s_client or an online SSL checker.",{"q":52,"a":53},"Why do I get ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Cloudflare?","Usually because Cloudflare has no edge certificate for that hostname yet. Universal SSL can take a while to issue for a new domain, and it only covers the apex and first-level subdomains, so a hostname like a.b.example.com needs an advanced or custom certificate. It can also happen if the hostname isn't proxied correctly.",{"q":55,"a":56},"Can a legacy system that only supports TLS 1.0 still send webhooks?","Not to a modern endpoint that has disabled TLS 1.0, which is most of them. The options are upgrading the system, or sending its webhooks to a relay input that accepts TLS 1.0 and forwards the events over modern TLS, as Webhook Relay's legacy TLS compatibility does on the Pro plan.",{"type":58,"children":59,"toc":592},"root",[60,80,118,147,178,185,248,254,278,284,294,327,340,348,463,475,485,495,501,528,540,563,575,586],{"type":61,"tag":62,"props":63,"children":64},"element","p",{},[65,78],{"type":61,"tag":66,"props":67,"children":68},"strong",{},[69,76],{"type":61,"tag":70,"props":71,"children":73},"code",{"className":72},[],[74],{"type":75,"value":11},"text",{"type":75,"value":77}," means the browser and the server share no TLS protocol version or cipher suite, so the secure connection can't be set up.",{"type":75,"value":79}," Modern browsers only speak TLS 1.2 and 1.3 with strong ciphers. A server that offers only TLS 1.0/1.1, only obsolete ciphers, or no usable certificate for the hostname triggers this error.",{"type":61,"tag":81,"props":82,"children":85},"pre",{"className":83,"code":84,"language":75,"meta":7,"style":7},"language-text shiki shiki-themes github-dark","This site can't provide a secure connection\nexample.com uses an unsupported protocol.\nERR_SSL_VERSION_OR_CIPHER_MISMATCH\n",[86],{"type":61,"tag":70,"props":87,"children":88},{"__ignoreMap":7},[89,100,109],{"type":61,"tag":90,"props":91,"children":94},"span",{"class":92,"line":93},"line",1,[95],{"type":61,"tag":90,"props":96,"children":97},{},[98],{"type":75,"value":99},"This site can't provide a secure connection\n",{"type":61,"tag":90,"props":101,"children":103},{"class":92,"line":102},2,[104],{"type":61,"tag":90,"props":105,"children":106},{},[107],{"type":75,"value":108},"example.com uses an unsupported protocol.\n",{"type":61,"tag":90,"props":110,"children":112},{"class":92,"line":111},3,[113],{"type":61,"tag":90,"props":114,"children":115},{},[116],{"type":75,"value":117},"ERR_SSL_VERSION_OR_CIPHER_MISMATCH\n",{"type":61,"tag":62,"props":119,"children":120},{},[121,123,129,131,137,139,145],{"type":75,"value":122},"In DevTools it appears as ",{"type":61,"tag":70,"props":124,"children":126},{"className":125},[],[127],{"type":75,"value":128},"net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH",{"type":75,"value":130},". Firefox shows ",{"type":61,"tag":70,"props":132,"children":134},{"className":133},[],[135],{"type":75,"value":136},"SSL_ERROR_UNSUPPORTED_VERSION",{"type":75,"value":138}," or ",{"type":61,"tag":70,"props":140,"children":142},{"className":141},[],[143],{"type":75,"value":144},"SSL_ERROR_NO_CYPHER_OVERLAP",{"type":75,"value":146},", and command-line clients print errors like:",{"type":61,"tag":81,"props":148,"children":150},{"className":83,"code":149,"language":75,"meta":7,"style":7},"curl: (35) error:0A000102:SSL routines::unsupported protocol\nerror:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version\njavax.net.ssl.SSLHandshakeException: Received fatal alert: protocol_version\n",[151],{"type":61,"tag":70,"props":152,"children":153},{"__ignoreMap":7},[154,162,170],{"type":61,"tag":90,"props":155,"children":156},{"class":92,"line":93},[157],{"type":61,"tag":90,"props":158,"children":159},{},[160],{"type":75,"value":161},"curl: (35) error:0A000102:SSL routines::unsupported protocol\n",{"type":61,"tag":90,"props":163,"children":164},{"class":92,"line":102},[165],{"type":61,"tag":90,"props":166,"children":167},{},[168],{"type":75,"value":169},"error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version\n",{"type":61,"tag":90,"props":171,"children":172},{"class":92,"line":111},[173],{"type":61,"tag":90,"props":174,"children":175},{},[176],{"type":75,"value":177},"javax.net.ssl.SSLHandshakeException: Received fatal alert: protocol_version\n",{"type":61,"tag":179,"props":180,"children":182},"h2",{"id":181},"common-causes",[183],{"type":75,"value":184},"Common causes",{"type":61,"tag":186,"props":187,"children":188},"ul",{},[189,200,210,220,238],{"type":61,"tag":190,"props":191,"children":192},"li",{},[193,198],{"type":61,"tag":66,"props":194,"children":195},{},[196],{"type":75,"value":197},"The server only supports TLS 1.0 or 1.1.",{"type":75,"value":199}," Chrome, Edge, Firefox and Safari have all removed them. Old appliances, embedded web UIs, legacy IIS and old Java servers are typical.",{"type":61,"tag":190,"props":201,"children":202},{},[203,208],{"type":61,"tag":66,"props":204,"children":205},{},[206],{"type":75,"value":207},"Only obsolete ciphers are enabled.",{"type":75,"value":209}," RC4, 3DES or export-grade suites that browsers no longer offer.",{"type":61,"tag":190,"props":211,"children":212},{},[213,218],{"type":61,"tag":66,"props":214,"children":215},{},[216],{"type":75,"value":217},"No certificate for that hostname.",{"type":75,"value":219}," The server has no certificate matching the SNI name, or the certificate uses a key type the server's TLS configuration can't use.",{"type":61,"tag":190,"props":221,"children":222},{},[223,228,230,236],{"type":61,"tag":66,"props":224,"children":225},{},[226],{"type":75,"value":227},"Cloudflare edge certificate not ready.",{"type":75,"value":229}," Universal SSL hasn't been issued yet for a new domain, or the hostname is a second-level subdomain (",{"type":61,"tag":70,"props":231,"children":233},{"className":232},[],[234],{"type":75,"value":235},"a.b.example.com",{"type":75,"value":237},") that Universal SSL doesn't cover.",{"type":61,"tag":190,"props":239,"children":240},{},[241,246],{"type":61,"tag":66,"props":242,"children":243},{},[244],{"type":75,"value":245},"Something in the middle.",{"type":75,"value":247}," Antivirus HTTPS scanning or an outdated corporate proxy that re-negotiates TLS with old settings.",{"type":61,"tag":179,"props":249,"children":251},{"id":250},"how-to-fix-it-as-a-visitor",[252],{"type":75,"value":253},"How to fix it as a visitor",{"type":61,"tag":255,"props":256,"children":257},"ol",{},[258,263,268,273],{"type":61,"tag":190,"props":259,"children":260},{},[261],{"type":75,"value":262},"Update your browser and operating system.",{"type":61,"tag":190,"props":264,"children":265},{},[266],{"type":75,"value":267},"Try another browser or network to see whether it's your device or the site.",{"type":61,"tag":190,"props":269,"children":270},{},[271],{"type":75,"value":272},"Turn off antivirus HTTPS or \"web shield\" scanning briefly to test.",{"type":61,"tag":190,"props":274,"children":275},{},[276],{"type":75,"value":277},"If the site is old or internal, contact its owner. Current Chrome has no setting to re-enable TLS 1.0/1.1, and doing so wouldn't be safe.",{"type":61,"tag":179,"props":279,"children":281},{"id":280},"how-to-fix-it-as-a-developer-or-ops",[282],{"type":75,"value":283},"How to fix it as a developer or ops",{"type":61,"tag":62,"props":285,"children":286},{},[287,292],{"type":61,"tag":66,"props":288,"children":289},{},[290],{"type":75,"value":291},"Enable modern TLS.",{"type":75,"value":293}," For nginx:",{"type":61,"tag":81,"props":295,"children":299},{"className":296,"code":297,"language":298,"meta":7,"style":7},"language-nginx shiki shiki-themes github-dark","ssl_protocols TLSv1.2 TLSv1.3;\nssl_prefer_server_ciphers off;\n# Cipher list: use Mozilla's \"intermediate\" configuration for your server version.\n","nginx",[300],{"type":61,"tag":70,"props":301,"children":302},{"__ignoreMap":7},[303,311,319],{"type":61,"tag":90,"props":304,"children":305},{"class":92,"line":93},[306],{"type":61,"tag":90,"props":307,"children":308},{},[309],{"type":75,"value":310},"ssl_protocols TLSv1.2 TLSv1.3;\n",{"type":61,"tag":90,"props":312,"children":313},{"class":92,"line":102},[314],{"type":61,"tag":90,"props":315,"children":316},{},[317],{"type":75,"value":318},"ssl_prefer_server_ciphers off;\n",{"type":61,"tag":90,"props":320,"children":321},{"class":92,"line":111},[322],{"type":61,"tag":90,"props":323,"children":324},{},[325],{"type":75,"value":326},"# Cipher list: use Mozilla's \"intermediate\" configuration for your server version.\n",{"type":61,"tag":62,"props":328,"children":329},{},[330,332,338],{"type":75,"value":331},"On Apache use ",{"type":61,"tag":70,"props":333,"children":335},{"className":334},[],[336],{"type":75,"value":337},"SSLProtocol -all +TLSv1.2 +TLSv1.3",{"type":75,"value":339},". On Windows/IIS, enable TLS 1.2 in the registry or with a tool like IIS Crypto, and on old Java runtimes upgrade the JDK.",{"type":61,"tag":62,"props":341,"children":342},{},[343],{"type":61,"tag":66,"props":344,"children":345},{},[346],{"type":75,"value":347},"Test what the server offers:",{"type":61,"tag":81,"props":349,"children":353},{"className":350,"code":351,"language":352,"meta":7,"style":7},"language-bash shiki shiki-themes github-dark","openssl s_client -connect example.com:443 -servername example.com -tls1_2\nopenssl s_client -connect example.com:443 -servername example.com -tls1_3\nnmap --script ssl-enum-ciphers -p 443 example.com\n","bash",[354],{"type":61,"tag":70,"props":355,"children":356},{"__ignoreMap":7},[357,398,430],{"type":61,"tag":90,"props":358,"children":359},{"class":92,"line":93},[360,366,372,378,383,388,393],{"type":61,"tag":90,"props":361,"children":363},{"style":362},"--shiki-default:#B392F0",[364],{"type":75,"value":365},"openssl",{"type":61,"tag":90,"props":367,"children":369},{"style":368},"--shiki-default:#9ECBFF",[370],{"type":75,"value":371}," s_client",{"type":61,"tag":90,"props":373,"children":375},{"style":374},"--shiki-default:#79B8FF",[376],{"type":75,"value":377}," -connect",{"type":61,"tag":90,"props":379,"children":380},{"style":368},[381],{"type":75,"value":382}," example.com:443",{"type":61,"tag":90,"props":384,"children":385},{"style":374},[386],{"type":75,"value":387}," -servername",{"type":61,"tag":90,"props":389,"children":390},{"style":368},[391],{"type":75,"value":392}," example.com",{"type":61,"tag":90,"props":394,"children":395},{"style":374},[396],{"type":75,"value":397}," -tls1_2\n",{"type":61,"tag":90,"props":399,"children":400},{"class":92,"line":102},[401,405,409,413,417,421,425],{"type":61,"tag":90,"props":402,"children":403},{"style":362},[404],{"type":75,"value":365},{"type":61,"tag":90,"props":406,"children":407},{"style":368},[408],{"type":75,"value":371},{"type":61,"tag":90,"props":410,"children":411},{"style":374},[412],{"type":75,"value":377},{"type":61,"tag":90,"props":414,"children":415},{"style":368},[416],{"type":75,"value":382},{"type":61,"tag":90,"props":418,"children":419},{"style":374},[420],{"type":75,"value":387},{"type":61,"tag":90,"props":422,"children":423},{"style":368},[424],{"type":75,"value":392},{"type":61,"tag":90,"props":426,"children":427},{"style":374},[428],{"type":75,"value":429}," -tls1_3\n",{"type":61,"tag":90,"props":431,"children":432},{"class":92,"line":111},[433,438,443,448,453,458],{"type":61,"tag":90,"props":434,"children":435},{"style":362},[436],{"type":75,"value":437},"nmap",{"type":61,"tag":90,"props":439,"children":440},{"style":374},[441],{"type":75,"value":442}," --script",{"type":61,"tag":90,"props":444,"children":445},{"style":368},[446],{"type":75,"value":447}," ssl-enum-ciphers",{"type":61,"tag":90,"props":449,"children":450},{"style":374},[451],{"type":75,"value":452}," -p",{"type":61,"tag":90,"props":454,"children":455},{"style":374},[456],{"type":75,"value":457}," 443",{"type":61,"tag":90,"props":459,"children":460},{"style":368},[461],{"type":75,"value":462}," example.com\n",{"type":61,"tag":62,"props":464,"children":465},{},[466,468,473],{"type":75,"value":467},"If both ",{"type":61,"tag":70,"props":469,"children":471},{"className":470},[],[472],{"type":75,"value":365},{"type":75,"value":474}," commands fail, the server has no modern protocol enabled. An online checker such as SSL Labs gives the same picture with a grade.",{"type":61,"tag":62,"props":476,"children":477},{},[478,483],{"type":61,"tag":66,"props":479,"children":480},{},[481],{"type":75,"value":482},"Check the certificate binding.",{"type":75,"value":484}," Confirm the hostname has a certificate in the server block or virtual host that actually answers for it, and that requests with SNI reach it.",{"type":61,"tag":62,"props":486,"children":487},{},[488,493],{"type":61,"tag":66,"props":489,"children":490},{},[491],{"type":75,"value":492},"On Cloudflare",{"type":75,"value":494},", open SSL/TLS > Edge Certificates and check that a certificate covers the hostname and is active. For deeper subdomains, add an advanced certificate or flatten the hostname.",{"type":61,"tag":179,"props":496,"children":498},{"id":497},"on-a-webhook-endpoint",[499],{"type":75,"value":500},"On a webhook endpoint",{"type":61,"tag":62,"props":502,"children":503},{},[504,506,511,513,519,520,526],{"type":75,"value":505},"The same mismatch happens between machines, and there's no browser message to see. A ",{"type":61,"tag":66,"props":507,"children":508},{},[509],{"type":75,"value":510},"legacy sender",{"type":75,"value":512}," (an old ERP, an on-prem appliance, an IoT controller) that can only do TLS 1.0/1.1 tries to post a webhook to a modern endpoint, and the handshake fails with ",{"type":61,"tag":70,"props":514,"children":516},{"className":515},[],[517],{"type":75,"value":518},"unsupported protocol",{"type":75,"value":138},{"type":61,"tag":70,"props":521,"children":523},{"className":522},[],[524],{"type":75,"value":525},"protocol_version",{"type":75,"value":527},". The event never arrives.",{"type":61,"tag":62,"props":529,"children":530},{},[531,533,538],{"type":75,"value":532},"The usual workaround is lowering TLS on the receiving server, which weakens every connection to it for one old client. A better option is to give the legacy sender its own Webhook Relay input with ",{"type":61,"tag":534,"props":535,"children":536},"a",{"href":20},[537],{"type":75,"value":40},{"type":75,"value":539},":",{"type":61,"tag":186,"props":541,"children":542},{},[543,553],{"type":61,"tag":190,"props":544,"children":545},{},[546,551],{"type":61,"tag":66,"props":547,"children":548},{},[549],{"type":75,"value":550},"Minimum TLS version",{"type":75,"value":552}," per input. The default is TLS 1.3; lower it to TLS 1.2 for senders that need it (Business and Pro).",{"type":61,"tag":190,"props":554,"children":555},{},[556,561],{"type":61,"tag":66,"props":557,"children":558},{},[559],{"type":75,"value":560},"Legacy TLS compatibility",{"type":75,"value":562}," accepts TLS versions down to 1.0 and a wider legacy cipher set on that one input (Pro).",{"type":61,"tag":62,"props":564,"children":565},{},[566,568,573],{"type":75,"value":567},"Webhook Relay completes the old handshake on that input and forwards the event onward over modern TLS. Every other input stays on TLS 1.3. The ",{"type":61,"tag":534,"props":569,"children":570},{"href":22},[571],{"type":75,"value":572},"TLS/SSL error reference",{"type":75,"value":574}," lists the exact error strings for curl, OpenSSL, Python, Node.js, Java and Go.",{"type":61,"tag":62,"props":576,"children":577},{},[578,580,584],{"type":75,"value":579},"If the browser complains about who signed the certificate rather than about protocols, that's a different error: see ",{"type":61,"tag":534,"props":581,"children":582},{"href":27},[583],{"type":75,"value":26},{"type":75,"value":585},".",{"type":61,"tag":587,"props":588,"children":589},"style",{},[590],{"type":75,"value":591},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":111,"depth":111,"links":593},[594,595,596,597],{"id":181,"depth":102,"text":184},{"id":250,"depth":102,"text":253},{"id":280,"depth":102,"text":283},{"id":497,"depth":102,"text":500},"markdown","content:http-errors:err-ssl-version-or-cipher-mismatch.md","content","http-errors/err-ssl-version-or-cipher-mismatch.md","http-errors/err-ssl-version-or-cipher-mismatch","md",{"loc":4},1793199803676]