Every time you try to connect to a new website, your browser will check the site’s SSL certificate automatically. It’s evidence that the website you’re visiting is legitimate and uses the right encryption protocol for your connection.
TLS handshake refers to this procedure. Secure connection between a user’s machine and a web server is guaranteed by the TLS (Transport Layer Security) protocol.
Let’s say that during the TLS handshake, the user’s browser and the web server discover that they do not share a common SSL protocol version or cipher suite. The browser will then show the appropriate error notice. ERR_SSL_VERSION_OR_CIPHER_MISMATCH.
What Does ERR_SSL_VERSION_OR_CIPHER_MISMATCH Error Mean?
The ERR_SSL_VERSION_OR_CIPHER_MISMATCH error indicates that the browser and the server cannot establish a secure connection due to incompatible sets of SSL/TLS protocols or cipher suites.
SSL (Secure Sockets Layer) and its successor, TLS (Transport Layer Security), are protocols used to secure communications between web browsers and servers. Cipher suites are sets of algorithms that help secure these communications.
Read Also:
Common Causes of the Error
- Outdated Server Configuration: If the server runs outdated SSL/TLS protocols or cipher suites that are no longer considered secure or supported by modern browsers.
- Client Browser Configuration: The browser might be outdated or configured to use SSL/TLS versions that are not supported by the server.
- Incorrect SSL Certificate Setup: Problems during the installation of an SSL certificate on the server can also trigger this error.
- Firewall or Security Appliance Restrictions: Network devices that perform packet inspections and restrict certain SSL/TLS versions can lead to this error.
How to Fix the ERR_SSL_VERSION_OR_CIPHER_MISMATCH Error
Despite its complex and daunting appearance, the ERR_SSL_VERSION_OR_CIPHER_MISMATCH issue is straightforward to resolve. Let’s have a look at the six possible solutions to the ERR SSL VERSION OR CIPHER MISMATCH problem.
Method 1: SSL Certificate Name Mismatch
The SSL Labs program could quickly determine that the ERR SSL VERSION OR CIPHER MISMATCH problem was caused by a name mismatch. When an SSL certificate doesn’t match the URL in the browser, a mismatch occurs.
This would be the case, for instance, if you were issued an SSL certificate for “www.testwebsite.com,” but actually accessed the site at “https://testwebsite.com” or another alias.
Fortunately, you may prevent this by changing the URL displayed in the browser to match the one listed in the SSL certificate.
Wildcard certificates, which permit several hostnames to share a single certificate, can also avert this issue. Google Chrome’s Developer Tools make it simple to verify the listed domains on a site’s security certificate:
Step 1: Click the “Inspect” button by right-clicking anywhere in the browser window.
Step 2: Choose the “Security” menu item.
Step 3: Inspect the certificate and network parameters under the ‘Security’ menu item (with the TLS version). If you want to see the certificate’s specifics, use the “See certificate” menu item.
Step 4: Click the “Details” button in the new window that appears.
Step 5: Seek out “Subject Alternate Name,” and then select it. The list of registered domain names can be found below.
If the domain resolves to an outdated IP address where the website no longer exists, a certificate name mismatch will result. The certificate name mismatch problem may be fixed by pointing the domain name away from the old IP address and toward the new one.
Method 2: Outdated TLS Version
With the SSL Labs tool, you may find out which version of TLS your site employs; as browsers no longer support TLS 1.0 and 1.1, you should use TLS 1.2 at the very least.
The ERR_SSL_VERSION_OR_CIPHER_MISMATCH issue could be caused by your site’s use of an unsupported TLS version. If this is the case, you need to contact your hosting provider about upgrading your website’s TLS version.
Method 3: RC4 Cipher Suite
You can see which ciphers a web server is presently using by running the SSL Labs test on it. Is there anything you can do if you discover a server is still operating with the RC4 cipher suite?
It should be turned off, and the server should be configured to use a different cipher suite. This is due to one basic fact: Due to security concerns, the RC4 cipher suite is no longer supported by popular browsers including Google Chrome and Microsoft Edge.
Companies continue to rely on this suite since updating the server architecture in a complex environment is labor-intensive and time-consuming.
Method 4: Turn Off the QUICK Protocol
To improve connections for web apps that rely on the User Datagram Protocol (UDP), Google developed an experimental protocol called Quick UDP Internet Connection (QUIC) (UDP).
While QUIC is widely regarded as a superior replacement for established protocols such as TLS/SSL, HTTP/2, and TCP, it has been known to cause errors such as ERR_SSL_VERSION_OR_CIPHER_MISMATCH.
It may be possible to resolve the issue by disabling the QUIC protocol. Let’s investigate the Chrome instructions for that:
Step 1: Open Chrome and go to the address bar. Type chrome:/flags.
Step 2: Try looking for “QUIC” on your search engine.
Step 3: The ‘Experimental QUIC Protocol’ is what you’re after.
Step 4: Choose “Disable” from the menu that appears.
Step 5: It should be noted that there are alternative techniques to disable the QUIC protocol (such as the Firewall Policy), but it is strongly advised that you do not use them due to the high level of technical expertise required.
Method 5: Deactivate Your Firewall or Antivirus Software
Incorrect firewall or antivirus software configuration can compromise your connection’s security and result in errors like ERR_SSL_VERSION_OR_CIPHER_MISMATCH.
Why? Due to the fact that a software’s certificates or a sloppy installation could generate a false positive, mislabeling a secure URL as dangerous.
It is recommended that you temporarily disable the antivirus program to determine if it is the source of the error.
Turning off automatic SSL scanning in antivirus software should, however, get rid of the problem notice without turning off the antivirus system entirely.
Additional Solutions
Use a Different Browser
Try accessing the website with a different browser to see if the issue persists. This can help identify if the problem is related to the browser itself.
Update Network Drivers
Outdated or corrupted network drivers can sometimes cause issues with SSL/TLS protocols:
- Update your network drivers from the device manager or visit the manufacturer’s website for the latest driver software.
Read Also:
Conclusion
Before establishing a connection with a website, any respectable browser will perform a TLS handshake. In order to ensure security, the TLS handshake verifies the SSL certificate of the connecting server.
If the website doesn’t have a current SSL certificate, any information exchanged with it is probably not secure. Even if a website doesn’t have an SSL certificate, visitors can still view it.
Several Chrome users have reported getting the ERR_SSL_VERSION_OR_CIPHER_MISMATCH error when trying to access a website. This error indicates that the SSL certificate is invalid.
SSL certificates are used to prove the safety of a website. This ERR_SSL_VERSION_OR_CIPHER_MISMATCH issue usually occurs when a certificate is too old. Admittedly, not all sites using an expired SSL certificate display this warning.
