SSL certificates

How to fix ERR_SSL_VERSION_OR_CIPHER_MISMATCH

ERR_SSL_VERSION_OR_CIPHER_MISMATCH means browser and server share no TLS version or cipher. Learn the causes, such as missing certificates, old TLS and new domains, and the fixes.

IntermediatecPanel hosting2 min read

ERR_SSL_VERSION_OR_CIPHER_MISMATCH ("This site can't provide a secure connection – uses an unsupported protocol") means your browser and the server could not agree on a TLS version or cipher suite. Modern browsers only accept TLS 1.2 and 1.3 with strong ciphers. The server is offering something older, or nothing suitable for that domain name.

Before you start

  • Test the domain on another device and browser.
  • Note whether the site uses Cloudflare or another CDN.

Common causes

  • No certificate for the domain on the server, so the handshake cannot match a site.
  • A new Cloudflare zone whose edge certificate is not issued yet, or a subdomain deeper than the Universal SSL covers (a.b.example.com).
  • Outdated TLS configuration on a VPS (TLS 1.0/1.1 only, RC4 or 3DES ciphers).
  • A very old browser or OS that does not support current TLS.

How to fix it

  1. Check the certificate exists. In cPanel → Security → SSL/TLS Status, confirm the domain is covered, and run AutoSSL if not. If it fails, see AutoSSL not working.
  2. On Cloudflare, check SSL/TLS → Edge Certificates. A new zone can take a little time to get its certificate. For multi-level subdomains, use an advanced certificate or keep the record DNS-only.
  3. Test protocols with openssl s_client -connect example.com:443 -servername example.com -tls1_2 and -tls1_3. Both failing means the server config needs updating.
  4. Update the VPS TLS config. For Nginx: ssl_protocols TLSv1.2 TLSv1.3;. For Apache: SSLProtocol -all +TLSv1.2 +TLSv1.3. Reload the web server.
  5. Update the browser if only one old device fails.

Tip: Cloudflare Universal SSL covers example.com and *.example.com only. A host like shop.eu.example.com is not covered and triggers this exact error.

FAQ

Is this error dangerous?

No data is exchanged; the browser refused to connect.

Why does it work on my PC but not an old phone?

The old phone lacks TLS 1.2/1.3 support. Updating the OS or browser fixes it.

Do MdmHost servers support TLS 1.3?

Our cPanel servers run LiteSpeed with modern TLS, so a valid certificate is usually all you need.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AIOpen a ticket

Related guides

SSL certificates

SNI explained: many SSL certificates on one IP address

How Server Name Indication lets a web server pick the right certificate for each domain on a shared IP, how Nginx, Apache and LiteSpeed use it, the default certificate problem and how to test SNI.

3 min read
SSL certificates

How to fix NET::ERR_CERT_AUTHORITY_INVALID

NET::ERR_CERT_AUTHORITY_INVALID means the browser does not trust whoever issued the certificate. Learn how self-signed certificates, missing chains and antivirus cause it.

2 min read
SSL certificates

How to fix NET::ERR_CERT_COMMON_NAME_INVALID

NET::ERR_CERT_COMMON_NAME_INVALID means the SSL certificate does not cover the domain you visited. Learn why it happens with www, subdomains and shared IPs, and how to fix it.

2 min read