How to fix ERR_SSL_VERSION_OR_CIPHER_MISMATCH
ERR_SSL_VERSION_OR_CIPHER_MISMATCH means the browser and server could not agree on a TLS protocol version or a cipher suite, so the handshake stopped. It is a configuration mismatch: usually a server pinned to deprecated protocols, or one offering only ciphers the browser has removed.
- Likely cause
- No shared TLS protocol version or cipher between client and server
- Severity
- High — affected clients cannot connect at all
- Time to fix
- About 15 minutes
- Prevention
- Offer TLS 1.2 and 1.3 with a modern cipher list
What causes it
- The server still offers only TLS 1.0 or 1.1, which current browsers have removed.
- The server offers only a narrow or outdated cipher list that the browser no longer supports.
- A security appliance in front of the server strips or rewrites the handshake.
How to fix it
1. Find which protocol versions the server accepts
Force each current version and see which the server accepts. Probing TLS 1.0 and 1.1 needs an older openssl or @SECLEVEL=0, since current builds disable them client-side, so the mismatch usually shows in 1.2 and 1.3.
for v in tls1_2 tls1_3; do echo "$v:"; openssl s_client -connect example.com:443 -$v </dev/null 2>&1 | grep -E "Protocol|handshake failure"; done2. Enable current protocols and ciphers
Set the server to offer TLS 1.2 and 1.3 with a modern cipher list, then test the config before reloading.
ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5;3. Reload and re-test a real browser handshake
Reload the server and confirm a current client negotiates TLS 1.2 or 1.3 cleanly.
sudo nginx -t && sudo systemctl reload nginx
How to prevent it
Keep a modern protocol and cipher baseline in your server config, retire old versions on a schedule, and grade the negotiated configuration from outside so a drift toward deprecated settings is caught early.
Source: Mozilla server-side TLS guidance
Common questions
Which protocols should I enable?
TLS 1.2 and TLS 1.3. TLS 1.0 and 1.1 are deprecated and removed from current browsers, so offering only those causes this error.
It fails on new browsers but works on old ones. Why?
The server is offering only deprecated protocols or ciphers. Old browsers still accept them; new ones have removed them, so the shared set is empty and the handshake fails.
Fixed it? Catch the next one before your visitors do — monitor the certificate from outside, 3 free, no card.