--- title: SSL/TLS Handshake Failed: causes and how to fix it description: When the secure connection can't be agreed, you get a handshake failure — and the page never loads. Here's what goes wrong during the TLS handshake, and how to fix each cause. canonical: https://watchfor.io/blog/ssl-handshake-failed --- [All posts](/blog) [Security](/blog/category/security) Feb 26, 2026 · 3 min read · WatchFor Team # SSL/TLS Handshake Failed: causes and how to fix it When the secure connection can't be agreed, you get a handshake failure — and the page never loads. Here's what goes wrong during the TLS handshake, and how to fix each cause. The connection just won't establish. Depending on the client you'll see "SSL handshake failed," ERR_SSL_PROTOCOL_ERROR , or a cryptic handshake timeout. The page doesn't load at all — and unlike a content error, there's no page to even show you what's wrong. A handshake failure means the browser and server couldn't agree on how to talk securely . Let's walk through where the [TLS handshake](/blog/how-https-works) breaks and how to fix each cause. ## A quick recap of the handshake Every HTTPS connection starts with a [TLS handshake](/blog/how-https-works): the client and server greet each other, agree on a protocol version and cipher, the server presents its certificate , and they exchange keys. If any of those steps can't complete, you get a handshake failure — before a single byte of your actual page is sent. ## The common causes Cause What broke Expired certificate The cert is past its validity date Certificate name mismatch The cert doesn't cover the hostname requested Incomplete chain The server didn't send the intermediate certificates Protocol mismatch Client and server share no supported TLS version Cipher mismatch No common cipher suite both sides accept Untrusted issuer A self-signed or unknown-authority certificate Clock skew The client's clock is so wrong the cert looks invalid ## How to fix each - Expired cert? Renew it — and add [expiry monitoring](/blog/ssl-certificate-expiry) so it never lapses again. This is the single most common cause. - Name mismatch? Make sure the certificate covers the exact hostname (including www vs apex, and any subdomains). - Incomplete chain? Configure the server to send the full chain (leaf + intermediates). A classic symptom: it works in one browser but fails in another, because some clients can't fill the gap themselves. - Protocol/cipher mismatch? Modern servers should support TLS 1.2 and 1.3 . If a server only offers ancient protocols, up-to-date clients refuse to connect (and vice versa). - Untrusted issuer? Use a certificate from a trusted authority for public sites; self-signed certs trigger failures everywhere. - Clock skew? Rare, but a badly-wrong client clock makes valid certs look expired or not-yet-valid. The 80% rule: most "handshake failed" reports are really an expired certificate or a missing intermediate chain . Check those two first and you'll fix the majority. ## How to catch it early A handshake failure is a total outage for HTTPS — nobody gets in. And the usual causes (expiry, chain changes after a renewal) are silent until they strike. Monitoring the certificate and the TLS connection itself — verifying the full chain and that the handshake actually completes — turns these from a Saturday surprise into an early warning. ## The bottom line In one line What Client and server couldn't agree on a secure connection. Top causes Expired cert, name mismatch, incomplete chain. Fix Renew, match the hostname, send the full chain, support modern TLS. Prevent Monitor certificate expiry and the handshake itself. A TLS handshake failure blocks everyone, but the causes are a short, well-known list. Check the certificate's expiry and chain first — that's where most failures live — and monitor them so the next renewal doesn't catch you out. Related: [How HTTPS works](/blog/how-https-works), [SSL certificate expiry](/blog/ssl-certificate-expiry); check any cert with the free [SSL checker](/ssl-checker). [#security](/blog/tag/security)[#debugging](/blog/tag/debugging)[#ssl](/blog/tag/ssl) ## Monitor your SSL/TLS certificates Get alerted well before certificates expire or a handshake breaks — checked from locations worldwide. [Learn more](/ssl-monitoring)[Start free](/auth/sign-up) Share this article --- Canonical page: https://watchfor.io/blog/ssl-handshake-failed · Site guide: https://watchfor.io/llms.txt