ERR_SSL_OBSOLETE_VERSION: Fix
ERR_SSL_OBSOLETE_VERSION — Chrome 84+ (July 2020) blocks HTTPS connections to servers supporting only TLS 1.0 or 1.1. Causes: old nginx/Apache, legacy IIS 7, embedded devices. Fix: enable TLS 1.2+1.3, disable 1.0 and 1.1. 10 minutes of work on a modern server.
This error blocks HTTPS access. Below: causes, fixes, working config, FAQ.
Common Causes
- nginx older than 1.13 cannot do TLS 1.3 (1.2 yes)
- Apache without a current mod_ssl is stuck at TLS 1.0/1.1
- OpenSSL < 1.0.1 cannot do TLS 1.2
- Router/firewall with legacy SSL proxy
- IoT devices (cameras, printers) only TLS 1.0
Step-by-Step Fix
- nginx:
ssl_protocols TLSv1.2 TLSv1.3;(do not include TLSv1 and TLSv1.1) - Apache:
SSLProtocol -all +TLSv1.2 +TLSv1.3 - Update OpenSSL:
apt update && apt upgrade openssl libssl-dev - Ensure nginx built with newer OpenSSL:
nginx -V 2>&1 | grep -i ssl - Then:
nginx -t && systemctl reload nginx
Related SSL Errors
Why teams trust us
How it works
Enter domain
TLS chain verified
Expiry date & vulnerabilities
What Does the SSL Check Cover?
SSL/TLS is the encryption protocol that protects data between the browser and server. Our tool analyzes the certificate, chain of trust, TLS version, and knownvulnerabilities.
Certificate Details
Issuer, validity period, signature algorithm, covered domains (SAN), and validation type (DV/OV/EV).
Chain of Trust
Full chain verification: from leaf certificate through intermediates to root CA.
TLS Analysis
Protocol version (TLS 1.2/1.3), cipher suites, Perfect Forward Secrecy (PFS) support.
Expiry Alerts
Set up a monitor — get Telegram and email alerts 30/14/7 days before expiration.
DV vs OV vs EV Certificates
- Confirms domain ownership only
- Issued in minutes automatically
- Free via Let's Encrypt
- Suitable for most websites
- Most common certificate type
- Organization (OV) or Extended Validation (EV)
- Issued in 1-5 business days
- Costs $50 to $500/year
- For finance, e-commerce, government sites
- Increases user trust
Who uses this
DevOps
SSL certificate monitoring
Security
TLS config audit
SEO
HTTPS as ranking factor
E-commerce
customer trust
Common Mistakes
www and subdomains.Best Practices
Strict-Transport-Security header forces browsers to always use HTTPS.Get more with a free account
SSL certificate monitoring, check history and alerts 30 days before expiry.
Sign up freeLearn more
How-to
Frequently Asked Questions
Which browsers blocked TLS 1.0/1.1?
Chrome 84 (July 2020), Firefox 78 (July 2020), Edge 84, Safari 14 (September 2020). By 2026 all modern browsers.
What if clients use old Android (API<21)?
Android < 5.0 cannot do TLS 1.2. Two options: keep a parallel subdomain with TLS 1.0 (DANGEROUS) or drop those clients. In 2026 it's <0.5% of traffic.
IoT device cannot reach server — disable TLS 1.2?
No. Put the device on a separate VLAN without internet and talk to it via TLS 1.0 internally, but your public site — TLS 1.2+1.3 only.
How do I check supported TLS?
<a href="/en/ssl">Enterno SSL</a> or in shell: <code>openssl s_client -connect example.com:443 -tls1_2</code>.