ERR_SSL_PROTOCOL_ERROR

If visitors to your site experience SSL protocol errors such as:

• ERR_SSL_PROTOCOL_ERROR (Chrome)
• Secure Connection Failed or PR_END_OF_FILE_ERROR (Firefox)
• Safari can't open the page because it couldn't establish a secure connection to the server (Safari)

These errors indicate that the SSL/TLS handshake failed. This can happen for many reasons, including certificate issues, protocol incompatibilities, or network interference.

Before investigating protocol-specific issues, verify that the error is not caused by:

• Certificate not yet active - If you recently added your domain, wait for your Universal SSL certificate to activate.
• Multi-level subdomain not covered - Universal SSL only covers one level of subdomains. Refer to ERR_SSL_VERSION_OR_CIPHER_MISMATCH for solutions.
• Cipher suite mismatch - Older clients may not support modern cipher suites. Refer to cipher suites for configuration options.

HTTP/3 uses the QUIC protocol over UDP, which some networks, firewalls, or devices do not fully support. If visitors experience intermittent SSL protocol errors, HTTP/3 may be the cause.

• Errors occur intermittently, not on every request
• The issue affects only some visitors (often those on corporate networks or certain ISPs)
• Visitors report the site works after refreshing multiple times
• The issue does not occur when using a VPN

Temporarily disable HTTP/3 to determine if it is the cause:

1. In the Cloudflare dashboard, go to the Protocol Optimization page. Go to Settings ↗
2. Turn off HTTP/3 (with QUIC).
3. Ask the affected visitor to test again.

If disabling HTTP/3 resolves the issue, the visitor's network likely blocks or mishandles UDP traffic on port 443. Re-enable HTTP/3 after testing and work with the visitor to identify the specific network issue.

TLS 1.3 is the latest version of the TLS protocol and provides improved security and performance. However, some network security devices that perform SSL/TLS inspection may not fully support TLS 1.3.

• Visitors using corporate networks with SSL inspection report connection issues
• Antivirus software with HTTPS scanning is installed on the visitor's device
• The error occurs consistently for specific visitors but not others

Temporarily disable TLS 1.3 to determine if it is the cause:

1. In the Cloudflare dashboard, go to the Edge Certificates page. Go to Edge Certificates ↗
2. Find TLS 1.3 and turn it off.
3. Ask the affected visitor to test again.

If disabling TLS 1.3 resolves the issue, the visitor's network has a middlebox (firewall, proxy, or antivirus) that does not support TLS 1.3. Re-enable TLS 1.3 after testing and ask the visitor to:

• Update their security software to a version that supports TLS 1.3
• Contact their IT department to update network security devices
• Temporarily disable HTTPS scanning in their antivirus software

If you cannot identify the root cause, contact Cloudflare Support with packet captures from the affected visitor showing the failed TLS handshake.

Some Internet Service Providers (ISPs) and corporate networks deploy security features that can interfere with HTTPS connections:

• Deep packet inspection (DPI) - Inspects encrypted traffic and may interfere with connections it cannot analyze
• SSL/TLS interception proxies - Intercept and re-encrypt traffic, which can fail with newer protocols
• Parental controls or content filters - May block or interfere with connections to certain sites
• Carrier-grade NAT (CGNAT) - Can cause connection issues, especially with UDP-based protocols like QUIC