SSL_ERROR_PROTOCOL_VERSION_ALERT: Causes

• Server stuck on TLS 1.0/1.1 (blocked by Chrome/Firefox since 2020)
• OpenSSL < 1.0.2 — no ALPN + TLS 1.2
• Legacy nginx (1.13-) — TLS 1.2 only, no 1.3
• Downgrade attack prevention: TLS_FALLBACK_SCSV detected
• Custom TLS config disabled the requested version

1. Enable TLS 1.2 + 1.3 in nginx: ssl_protocols TLSv1.2 TLSv1.3;
2. Update OpenSSL to 3.x
3. Check supported TLS: openssl s_client -connect example.com:443 -tls1_3
4. Enterno SSL Checker lists all supported TLS versions
5. See the nginx SSL install guide

Check SSL Certificate →

• ERR_SSL_PROTOCOL_ERROR
• NET::ERR_CERT_AUTHORITY_INVALID
• SSL Handshake Failed
• All SSL errors

The SSL_ERROR_PROTOCOL_VERSION_ALERT indicates a TLS version mismatch between a client's browser and a server, preventing secure connections. To resolve this, ensure your server supports modern TLS versions (1.2 or 1.3) by updating your server configuration and certificates. Use openssl s_client -connect yourdomain.com:443 -tls1_2 to verify supported protocols.

The SSL_ERROR_PROTOCOL_VERSION_ALERT error occurs when a client attempts to establish a secure connection using a version of TLS that the server does not support. This mismatch is often due to outdated server configurations or deprecated TLS versions. As of October 2023, TLS 1.2 and TLS 1.3 are the recommended versions for secure communications, as earlier versions such as TLS 1.0 and 1.1 are considered insecure and are often disabled in modern browsers.

When a browser encounters this error, it typically means that the server is configured to accept only older versions of TLS that the browser has stopped supporting. This situation can arise in various scenarios, such as when using legacy systems or when server software has not been updated to comply with current security standards.

To troubleshoot this issue, you can use tools such as openssl to check which TLS versions your server supports. For example, running the following command can help identify the supported protocols:

openssl s_client -connect yourdomain.com:443 -tls1_2

If the connection fails with a protocol version error, you will need to update your server configuration to support at least TLS 1.2. This may involve modifying your web server settings, updating your SSL/TLS certificates, or upgrading your server software.

To resolve the SSL_ERROR_PROTOCOL_VERSION_ALERT error, follow these steps to ensure your server supports the necessary TLS versions:

1. Check Current TLS Configuration: Use the openssl command as shown above to determine the supported TLS versions on your server. If TLS 1.2 or 1.3 is not listed, proceed to the next steps.
2. Update Server Software: Ensure that your web server software (such as Apache, Nginx, or IIS) is up-to-date. For example:

sudo apt-get update && sudo apt-get upgrade

1. Modify Server Configuration: Update your server configuration files to enable TLS 1.2 or 1.3. For Apache, you can edit the ssl.conf file and include:

SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1

1. Restart the Server: After making changes, restart your web server to apply the new configuration:

sudo systemctl restart apache2

1. Verify Changes: Re-run the openssl command to confirm that the server now supports TLS 1.2 or 1.3.
2. Check SSL/TLS Certificates: Ensure your SSL/TLS certificates are valid and configured correctly. Use certbot for Let's Encrypt certificates:

sudo certbot renew

After following these steps, test the connection using your browser again. If the error persists, consider consulting your server documentation or reaching out for professional support to ensure compliance with modern security standards.