Blog
3 min read

ERR_SSL_PROTOCOL_ERROR: What It Means and How to Fix It

ERR_SSL_PROTOCOL_ERROR means the browser couldn't complete a secure HTTPS connection because the server's response wasn't valid TLS. The usual causes — HTTPS pointed at a port speaking plain HTTP, a missing certificate, localhost over https, Cloudflare SSL modes — and how to fix each.

ERR_SSL_PROTOCOL_ERROR appears in Chrome as "This site can't provide a secure connection — sent an invalid response." It means your browser tried to start an encrypted HTTPS connection and the server didn't answer in the TLS language the browser expected.

It's different from certificate warnings like "Your connection is not private", where the server does speak TLS but its certificate is wrong. (Your Connection Is Not Private)

If you're a visitor

  1. Check the date and time on your device. A wrong clock breaks HTTPS.
  2. Try another browser or a private window, and disable extensions.
  3. Clear the SSL state (Windows: Internet Options → Content → Clear SSL state) and Chrome's cache.
  4. Turn off VPN or antivirus HTTPS scanning temporarily — some intercept connections badly.
  5. Try http:// instead of https:// to see whether the site works at all.

If it fails everywhere, it's the site's problem.

If it's your site

Cause 1: HTTPS pointed at a port that speaks plain HTTP

The most common cause by far. Your server (or app) is listening on a port but serving unencrypted HTTP, and the browser is connecting with https://. For example, visiting https://yourapp.com:3000 when your Node app on port 3000 only speaks HTTP.

Test from the terminal:

curl -v https://yourapp.com
curl -v http://yourapp.com:443

If http://...:443 returns a normal page, port 443 isn't doing TLS. Put a reverse proxy (Nginx, Caddy) in front that terminates HTTPS on 443 and forwards plain HTTP to your app. (Reverse Proxy Explained)

Cause 2: No certificate configured for this domain

Nginx has a listen 443 block, but no certificate for the hostname being requested, or the config failed to load. Check:

sudo nginx -t
sudo journalctl -u nginx -n 50

Then issue a certificate. (Certbot and Let's Encrypt)

Cause 3: https://localhost

Your dev server runs on http://localhost:3000, and you (or a redirect, or HSTS) sent the browser to https://localhost:3000. Use http:// locally. If Chrome keeps forcing HTTPS for localhost, delete the domain's HSTS entry at chrome://net-internals/#hsts. (What Is Localhost?)

Cause 4: Cloudflare SSL mode mismatch

With Cloudflare in front, its SSL/TLS mode must match your server. If Cloudflare is set to "Full" but your origin only serves HTTP on port 443 — or the reverse — connections can fail with protocol or 525 errors. Install a certificate on your origin and use Full (strict). (Cloudflare 521, 522, 525)

Cause 5: Old TLS versions or ciphers

Modern browsers refuse TLS 1.0 and 1.1. An old server config that only offers those fails. Allow TLS 1.2 and 1.3. (TLS Handshake Explained)

The summary

  • The server didn't speak valid TLS when the browser expected HTTPS.
  • Most often: https:// sent to a port serving plain HTTP, or no certificate configured.
  • Locally, use http://localhost; with Cloudflare, use Full (strict) with a real origin certificate.

EasySpawn terminates HTTPS for your domains with automatically renewed certificates and modern TLS settings, so your app only ever has to speak plain HTTP behind it. See how it works or join the waitlist.

Related: What Is an SSL Certificate? · How Automatic SSL Works · What Is HTTPS? · ERR_TOO_MANY_REDIRECTS

Keep reading