The short version
- 01Record the exact hostname, time and whether the error affects every visit or only some connections.
- 02Compare the same URL on another permitted network.
- 03Send the network comparison to the site owner or workplace IT team.
- 04As a Cloudflare owner, verify an active certificate that covers the requested hostname.
- 05For intermittent HTTP/3 failures, temporarily test with HTTP/3 disabled and restore it after the comparison.
- 06Have IT investigate and update incompatible TLS-inspection devices when the failure follows a managed network.
Raw message
ERR_SSL_PROTOCOL_ERROR
Likely causes
- The HTTPS connection fails during its TLS handshake.
- An inactive or unsuitable edge certificate prevents a Cloudflare HTTPS connection.
- Network handling of HTTP/3 or TLS inspection may interrupt affected connections.
Visitors: compare a permitted network
Cloudflare describes this error as a TLS handshake failure. Our first comparison keeps the URL unchanged and tests another permitted network. Give the owner or IT team the hostname, time and result; a network-specific difference is evidence to investigate, not a certificate diagnosis by itself.
Cloudflare owners: check certificate status and coverage
Cloudflare's procedure first checks that the edge certificate is active and covers the hostname. Use the actual certificate and DNS setup to verify coverage. The related certificate-name article explains the distinction between full DNS and partial CNAME setups; do not assume every Universal SSL certificate covers every nested subdomain.
Use a temporary protocol test to investigate intermittent failures
Cloudflare documents HTTP/3 using QUIC over UDP port 443 and TLS-inspection compatibility as possible causes. Its HTTP/3 comparison temporarily disables the feature, tests affected connections and restores it. For a managed-network failure, our recommendation is to have IT update incompatible inspection equipment rather than permanently reduce TLS security for all visitors.
Sources and review notes
Checked on . Based on Cloudflare's ERR_SSL_PROTOCOL_ERROR and Universal SSL documentation. The owner procedures here are Cloudflare-specific; another host needs its corresponding TLS investigation. Keeping the URL fixed and reporting comparison results are editorial guidance. Glitchary is independent of Google and Cloudflare.