LightAtom

ERR_SSL_VERSION_OR_CIPHER_MISMATCH: How to Fix It

The browser and server have no TLS version or cipher in common, usually because the server only offers outdated ones, or because no certificate exists for that host name yet.

ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Your browser only speaks modern, secure encryption, and the website offered nothing it accepts. There's no safe way to connect until the site updates.

Quick checks

  • Check whether the site loads in another browser; if none can open it, the server is outdated.
  • Check the exact host name: a subdomain may not have a certificate yet.

Fixes on Mac

  1. Update your browser and macOS

    1. Install updates; an outdated browser can also lack newer ciphers.

  2. Disable HTTPS-inspecting software

    1. Security tools that intercept TLS can offer the browser a weaker connection than it accepts. Pause them and retry.

Fixes on Windows

  1. Update and clear SSL state

    1. Install Windows and browser updates, then Internet Options › Content › Clear SSL state.

Other devices

  1. Other devices

    1. If an old internal device (printer, router, camera) shows this, use its local app or update its firmware.

Still not working?

Site owners: support TLS 1.2 and 1.3 with modern AEAD ciphers (AES-GCM, ChaCha20-Poly1305). Browsers removed TLS 1.0 and 1.1 in 2020. Check what your server offers with openssl s_client -connect example.com:443 -tls1_2 and -tls1_3.

On Cloudflare, this error also appears for host names not covered by your edge certificate, such as a second-level subdomain (a.b.example.com) under Universal SSL, or a domain whose certificate is still being issued.

See what’s happening

LightAtom's connections view shows whether your browser connects to a proxy address instead of the site's servers, and which process runs that proxy.

Frequently asked questions

What causes ERR_SSL_VERSION_OR_CIPHER_MISMATCH?

The server only supports old TLS versions (1.0/1.1) or weak ciphers (RC4, 3DES), or it has no certificate for the host name, so there's nothing the browser can safely agree to.

Can I force Chrome to accept old TLS?

No. Chrome removed support for TLS 1.0 and 1.1 for security reasons. The site has to be updated.

Why does it happen on a new Cloudflare subdomain?

Universal SSL covers the apex and one level of subdomains. Deeper subdomains, or a certificate still being issued, produce this error until a covering certificate exists.

Related errors and tools

Related

LightAtom team

The people who build LightAtom, a network monitor for macOS.