How to Fix ERR_SSL_VERSION_OR_CIPHER_MISMATCH

ERR_SSL_VERSION_OR_CIPHER_MISMATCH occurs when a browser and server cannot agree on a TLS version or cipher during the SSL handshake.

This guide covers server-side and client-side fixes.

Common Causes

• invalid or expired SSL certificate
• domain mismatch in certificate
• outdated TLS versions (TLS 1.0 / 1.1)
• insecure cipher suites (e.g. RC4)
• outdated root certificates
• mixed HTTPS/HTTP content

Fix 1 — Check SSL Certificate

• verify expiration date
• ensure certificate matches domain
• reinstall or renew if needed

Fix 2 — Match Domain Name

Ensure:

• domain = certificate CN/SAN
• CDN config includes domain
• SNI is enabled for multi-domain setups

Fix 3 — Upgrade TLS

Disable old protocols and allow modern ones:

sudo nano /etc/apache2/mods-enabled/ssl.conf

SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1

Requires TLS 1.2 / 1.3 support.

Fix 4 — Disable RC4 Cipher

SSLCipherSuite HIGH:!aNULL:!MD5:!RC4

RC4 is deprecated and blocked by modern browsers.

Fix 5 — Update Root Certificates

Linux:

sudo apt-get update
sudo apt-get install ca-certificates

Windows:

certutil -generateSSTFromWU roots.sst

Outdated certificates can break TLS handshake.

Fix 6 — Check Mixed Content

• open DevTools (F12)
• check Console
• replace HTTP resources with HTTPS

Client-side Fixes

• try another device
• clear cache and cookies
• update browser / OS

Summary

• enable TLS 1.2 / 1.3
• use valid SSL certificate
• disable weak ciphers (RC4)
• ensure domain matches certificate
• update root certificates

Full guide 👉 https://vsys.host/how-to/how-to-fix-err_ssl_version_or_cipher_mismatch