The connection just won't establish. Depending on the client you'll see "SSL handshake failed," ERR_SSL_PROTOCOL_ERROR, or a cryptic handshake timeout. The page doesn't load at all — and unlike a content error, there's no page to even show you what's wrong.
A handshake failure means the browser and server couldn't agree on how to talk securely. Let's walk through where the TLS handshake breaks and how to fix each cause.
A quick recap of the handshake
Every HTTPS connection starts with a TLS handshake: the client and server greet each other, agree on a protocol version and cipher, the server presents its certificate, and they exchange keys. If any of those steps can't complete, you get a handshake failure — before a single byte of your actual page is sent.
The common causes
| Cause | What broke |
|---|---|
| Expired certificate | The cert is past its validity date |
| Certificate name mismatch | The cert doesn't cover the hostname requested |
| Incomplete chain | The server didn't send the intermediate certificates |
| Protocol mismatch | Client and server share no supported TLS version |
| Cipher mismatch | No common cipher suite both sides accept |
| Untrusted issuer | A self-signed or unknown-authority certificate |
| Clock skew | The client's clock is so wrong the cert looks invalid |
How to fix each
- Expired cert? Renew it — and add expiry monitoring so it never lapses again. This is the single most common cause.
- Name mismatch? Make sure the certificate covers the exact hostname (including
wwwvs apex, and any subdomains). - Incomplete chain? Configure the server to send the full chain (leaf + intermediates). A classic symptom: it works in one browser but fails in another, because some clients can't fill the gap themselves.
- Protocol/cipher mismatch? Modern servers should support TLS 1.2 and 1.3. If a server only offers ancient protocols, up-to-date clients refuse to connect (and vice versa).
- Untrusted issuer? Use a certificate from a trusted authority for public sites; self-signed certs trigger failures everywhere.
- Clock skew? Rare, but a badly-wrong client clock makes valid certs look expired or not-yet-valid.
The 80% rule: most "handshake failed" reports are really an expired certificate or a missing intermediate chain. Check those two first and you'll fix the majority.
How to catch it early
A handshake failure is a total outage for HTTPS — nobody gets in. And the usual causes (expiry, chain changes after a renewal) are silent until they strike. Monitoring the certificate and the TLS connection itself — verifying the full chain and that the handshake actually completes — turns these from a Saturday surprise into an early warning.
The bottom line
| In one line | |
|---|---|
| What | Client and server couldn't agree on a secure connection. |
| Top causes | Expired cert, name mismatch, incomplete chain. |
| Fix | Renew, match the hostname, send the full chain, support modern TLS. |
| Prevent | Monitor certificate expiry and the handshake itself. |
A TLS handshake failure blocks everyone, but the causes are a short, well-known list. Check the certificate's expiry and chain first — that's where most failures live — and monitor them so the next renewal doesn't catch you out.
Related: How HTTPS works, SSL certificate expiry; check any cert with the free SSL checker.