---
title: SSL/TLS Handshake Failed: causes and how to fix it
description: When the secure connection can't be agreed, you get a handshake failure — and the page never loads. Here's what goes wrong during the TLS handshake, and how to fix each cause.
canonical: https://watchfor.io/blog/ssl-handshake-failed
---

# SSL/TLS Handshake Failed: causes and how to fix it

2026-02-26 · WatchFor Team · Security · security, debugging, ssl

When the secure connection can't be agreed, you get a handshake failure — and the page never loads. Here's what goes wrong during the TLS handshake, and how to fix each cause.

The connection just won't establish. Depending on the client you'll see *"SSL handshake failed,"* `ERR_SSL_PROTOCOL_ERROR`, or a cryptic handshake timeout. The page doesn't load at all — and unlike a content error, there's no page to even show you what's wrong.

A handshake failure means the browser and server **couldn't agree on how to talk securely**. Let's walk through where the [TLS handshake](/blog/how-https-works) breaks and how to fix each cause.

## A quick recap of the handshake

Every HTTPS connection starts with a [TLS handshake](/blog/how-https-works): the client and server greet each other, agree on a protocol version and cipher, the server presents its **certificate**, and they exchange keys. If *any* of those steps can't complete, you get a handshake failure — before a single byte of your actual page is sent.

## The common causes

| Cause | What broke |
| --- | --- |
| **Expired certificate** | The cert is past its validity date |
| **Certificate name mismatch** | The cert doesn't cover the hostname requested |
| **Incomplete chain** | The server didn't send the intermediate certificates |
| **Protocol mismatch** | Client and server share no supported TLS version |
| **Cipher mismatch** | No common cipher suite both sides accept |
| **Untrusted issuer** | A self-signed or unknown-authority certificate |
| **Clock skew** | The client's clock is so wrong the cert looks invalid |

## How to fix each

1. **Expired cert?** Renew it — and add [expiry monitoring](/blog/ssl-certificate-expiry) so it never lapses again. This is the single most common cause.
2. **Name mismatch?** Make sure the certificate covers the exact hostname (including `www` vs apex, and any subdomains).
3. **Incomplete chain?** Configure the server to send the **full chain** (leaf + intermediates). A classic symptom: it works in one browser but fails in another, because some clients can't fill the gap themselves.
4. **Protocol/cipher mismatch?** Modern servers should support **TLS 1.2 and 1.3**. If a server only offers ancient protocols, up-to-date clients refuse to connect (and vice versa).
5. **Untrusted issuer?** Use a certificate from a trusted authority for public sites; self-signed certs trigger failures everywhere.
6. **Clock skew?** Rare, but a badly-wrong client clock makes valid certs look expired or not-yet-valid.

> **The 80% rule:** most "handshake failed" reports are really an **expired certificate** or a **missing intermediate chain**. Check those two first and you'll fix the majority.

## How to catch it early

A handshake failure is a **total outage** for HTTPS — nobody gets in. And the usual causes (expiry, chain changes after a renewal) are silent until they strike. Monitoring the certificate and the TLS connection itself — verifying the full chain and that the handshake actually completes — turns these from a Saturday surprise into an early warning.

## The bottom line

| | In one line |
| --- | --- |
| **What** | Client and server couldn't agree on a secure connection. |
| **Top causes** | Expired cert, name mismatch, incomplete chain. |
| **Fix** | Renew, match the hostname, send the full chain, support modern TLS. |
| **Prevent** | Monitor certificate expiry and the handshake itself. |

A TLS handshake failure blocks everyone, but the causes are a short, well-known list. Check the certificate's expiry and chain first — that's where most failures live — and monitor them so the next renewal doesn't catch you out.

Related: [How HTTPS works](/blog/how-https-works), [SSL certificate expiry](/blog/ssl-certificate-expiry); check any cert with the free [SSL checker](/ssl-checker).

---

Canonical page: https://watchfor.io/blog/ssl-handshake-failed · All articles: https://watchfor.io/blog/all.md · Site guide: https://watchfor.io/llms.txt