ERR_SSL_RENEGOTIATION_NOT_SUPPORTED

• TLS 1.3 removed renegotiation — server still tries
• mTLS (client-auth): server requests cert after handshake via re-neg
• Legacy Java applications with renegotiation-based key refresh
• Apache + SSLVerifyClient require inside
• Old JVM (

1. TLS 1.3: move to post-handshake authentication (RFC 8446)
2. TLS 1.2 + mTLS: request clientauth at port/host level, not via re-neg
3. nginx + mTLS: ssl_verify_client optional_no_ca; ssl_client_certificate
4. Remove renegotiation from client pool/library settings
5. Update client Java/OpenSSL/curl to TLS 1.3 support

Check SSL Certificate →

• NET::ERR_CERT_AUTHORITY_INVALID
• ERR_SSL_PROTOCOL_ERROR
• SSL Handshake Failed
• All SSL errors

The ERR_SSL_RENEGOTIATION_NOT_SUPPORTED error indicates that the server does not support TLS renegotiation, a security feature used to negotiate a new session key during an existing TLS session. This can lead to failed connections, particularly in browsers like Chrome or Firefox. Fixing this error generally involves updating server configurations to allow renegotiation or ensuring that the server's TLS settings comply with modern standards such as RFC 5246.

The ERR_SSL_RENEGOTIATION_NOT_SUPPORTED error typically arises from server configurations that restrict TLS renegotiation due to security concerns. TLS renegotiation allows a client and server to negotiate new session parameters without requiring a full handshake. However, not all servers are configured to support this feature, which can lead to the error when clients attempt to renegotiate:

• Server Configuration: If the server is configured to reject renegotiation requests, clients will encounter this error.
• Outdated Software: Older versions of web servers or SSL libraries may not fully support modern TLS renegotiation standards.
• Client-Side Issues: Sometimes, the error may arise from specific browser settings or extensions that block renegotiation attempts.

To resolve the issue, administrators must analyze server logs to identify the source of the error and ensure that the server is configured to support secure renegotiation.

To address the ERR_SSL_RENEGOTIATION_NOT_SUPPORTED error, follow these steps:

1. Update Your Server Software: Ensure that your web server software (e.g., Apache, Nginx) and SSL/TLS libraries (OpenSSL) are up to date. Use the commands below depending on your server type:

# For Ubuntu/Debian systems
sudo apt update
sudo apt upgrade
# For CentOS/RHEL systems
sudo yum update

1. Enable TLS Renegotiation: Modify your server configuration files to allow secure TLS renegotiation. For example, in Nginx, include the following in your server block:

ssl_renegotiation on;

1. Configure SSL Parameters: Ensure that the SSL parameters comply with RFC 5746 to support secure renegotiation. For example, in Apache, add the following lines to your configuration:

SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
SSLCipherSuite HIGH:!aNULL:!MD5

1. Test SSL Configuration: Use tools like SSL Labs' SSL Test to verify that your server supports secure renegotiation. This can help identify any remaining issues.

By following these steps, you can effectively resolve the ERR_SSL_RENEGOTIATION_NOT_SUPPORTED error and ensure secure communications between clients and your server.

The ERR_SSL_RENEGOTIATION_NOT_SUPPORTED error indicates that a web server does not support TLS renegotiation, a security feature that allows a client and server to renegotiate the parameters of an existing TLS connection. This can occur due to server configuration or outdated software. To resolve this issue, ensure that your server is configured to support TLS renegotiation according to RFC 5746 and that your SSL/TLS library is up to date.

TLS renegotiation is a process that allows a client and server to negotiate new session parameters without terminating the existing connection. This can be useful for updating cryptographic keys or altering session attributes. However, the ERR_SSL_RENEGOTIATION_NOT_SUPPORTED error arises when a server does not support this feature, typically due to security configurations or outdated software libraries.

In 2009, the renegotiation attack vulnerability was discovered, leading to the introduction of RFC 5746, which defines secure renegotiation. Compliance with this RFC is crucial for maintaining secure connections. The error often indicates that the server is not configured to allow renegotiation or that the client is using a browser that does not support the server's SSL/TLS configuration.

To check if your server supports TLS renegotiation, you can use tools like openssl. Here’s a command you can run from your terminal:

openssl s_client -connect yourdomain.com:443 -tlsextdebug

If renegotiation is supported, you will see a response indicating the TLS extensions being used. If not, you may need to review your server configuration.

In summary, understanding the nuances of TLS renegotiation is essential for troubleshooting the ERR_SSL_RENEGOTIATION_NOT_SUPPORTED error. Ensure your server is compliant with RFC 5746 and that all software components are current to mitigate this issue.

To fix the ERR_SSL_RENEGOTIATION_NOT_SUPPORTED error, you must configure your web server to enable TLS renegotiation. This process varies depending on the server software you are using. Below are configuration examples for Apache and Nginx, two widely used web servers.

Apache Configuration

For Apache, you need to ensure that the SSLProtocol directive includes support for TLS 1.2 or higher. You can do this by editing your Apache configuration file (usually located at /etc/httpd/conf/httpd.conf or /etc/apache2/sites-available/default-ssl.conf). Add or modify the following lines:

SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1

Additionally, ensure that the SSLRenegBufferSize directive is set to a value greater than zero:

SSLRenegBufferSize 1048576

After making these changes, restart Apache to apply the configuration:

sudo systemctl restart apache2

Nginx Configuration

For Nginx, you can enable TLS renegotiation by ensuring that the ssl_protocols directive includes at least TLS 1.2. Edit your Nginx configuration file (typically located at /etc/nginx/nginx.conf or /etc/nginx/conf.d/default.conf) and include the following:

ssl_protocols TLSv1.2 TLSv1.3;

To check if renegotiation is enabled, you can add the ssl_renegotiation directive within your server block:

ssl_renegotiation on;

After saving your changes, restart Nginx:

sudo systemctl restart nginx

By ensuring that your server is properly configured to support TLS renegotiation, you can resolve the ERR_SSL_RENEGOTIATION_NOT_SUPPORTED error and enhance the security of your web application.