How to fix "sent an invalid response" ERR_SSL_PROTOCOL_ERROR on Google Chrome?

"Sent an invalid response. ERR_SSL_PROTOCOL_ERROR" in Chrome means that Chrome asked the site for an encrypted connection and the answer was not valid TLS. The cause is the website's server, something on your network that cuts into the connection, or an https:// address on a port that only speaks HTTP. Open the same address on mobile data first: that one test shows which of the three you have.

Facts checked on 14 October 2026. Steps written for Chrome 155 on Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What "sent an invalid response" and ERR_SSL_PROTOCOL_ERROR mean

When an address starts with https://, Chrome opens a connection to the server and starts a TLS handshake. TLS is the current name of what used to be called SSL, which is why the code still says SSL. The handshake is a fixed exchange of messages in a fixed format. If what comes back does not fit that format, Chrome cannot build an encrypted connection and stops.

Chromium's list of network errors gives this case the number -107 and the description "An SSL protocol error occurred". The error page pairs it with the heading This site can't provide a secure connection and the sentence "(site name) sent an invalid response." The site name in that sentence is simply the host you typed. It is not proof that the site itself wrote the bad answer.

What an "invalid response" is, and which errors look similar

Every TLS message starts with a short header that carries a record type and a version number. Before any encryption is agreed, Chrome's TLS library checks the first byte of that version number. Ordinary text fails the check at once. A web server that answers a TLS hello with an HTTP reply such as HTTP/1.1 400 Bad Request sends exactly such text, and so does a filter that pushes its own block page into the connection.

One more route into this code is written down in Chromium's source. A TLS alert called access_denied is meant for sign-in with client certificates. The developers note that "some buggy firewalls use it when blocking a page", and to avoid a confusing message Chrome turns that alert into the generic protocol error when no certificate was asked for.

What causes ERR_SSL_PROTOCOL_ERROR, from most to least likely

For a visitor the cause is most often outside the PC: the site's server answers badly, or a filter, firewall, VPN or provider on the way answers in its place. Less often a security program on the PC opens HTTPS traffic and fails. For developers and for owners of routers and other home devices, the usual cause is HTTPS requested from a port that only speaks HTTP. A damaged Chrome profile is the rare case.

How to fix ERR_SSL_PROTOCOL_ERROR in Chrome

Fix 1 is a test and takes two minutes: it tells you whether to go on with your own PC and network or to leave the repair to the site. Fixes 2 to 5 are for visitors. Fix 6 is for localhost and development servers, Fix 7 for website owners. Fix 8 holds the general clean-up that Google lists for every connection error.

Fix 1. Open the site on another network and another device

2 minutesNo riskYou see the error on a website and want to know whose fault it is before you change anything.

The error page cannot say who sent the invalid response. The same address on a different connection and a different device can: Cloudflare gives this test to site owners as the way to identify interference by a network or provider.

1. Select Reload on the error page once. Google's first step for every loading error is to check the address for typing mistakes and reload.
2. Open another HTTPS site in a new tab, for example https://www.google.com. Note whether only one site fails or many.
3. Take a phone, turn off its Wi-Fi so it uses mobile data, and open the same address in its browser.
4. On the PC, open the address in a second browser if you have one, such as Microsoft Edge.
5. If another PC or phone is on your Wi-Fi, open the address there as well.
6. Read the result in the table below and go to the fix it names.

Fix 2. Check the address: https on a port that only speaks HTTP

1 minuteLow riskThe address is an IP address, has a port number, or belongs to a router, printer, camera, NAS or another device on your own network.

A port that serves plain HTTP answers a TLS hello with HTTP text, and Chrome reads that as an invalid response. Apache's documentation names the case directly: connecting via HTTPS to a server that does not support it, or that supports it on another port.

1. Look at the address bar. Select the address to see it in full, with https:// in front.
2. If it ends with a port, such as https://192.168.1.1:8080, note the number after the colon.
3. Change https:// to http://, leave the rest as it is, and press Enter.
4. If the device's manual lists a separate port for HTTPS, use that port with https:// instead.
5. If a bookmark or a saved link opened the wrong address, edit it so the next visit goes to the right one.

• Why https appeared by itself. Chrome tries to upgrade some http:// visits to HTTPS. With Always use secure connections turned on, Google says Chrome upgrades addresses to HTTPS and displays a warning before you visit a site that does not support it.
• Where the switch is. More (the three dots), then Settings, then Privacy and security, then Security, under Secure connections. You can choose warnings for public sites only, so devices on your own network are left alone.
• Any port can be HTTPS. Apache's documentation notes that HTTPS can run on any port and that a browser only looks at 443 by default. The port number alone does not tell you which protocol is behind it.

Fix 3. Rule out the VPN, the proxy and HTTPS scanning by security software

10 to 20 minutesLow riskThe site opens on another network or another device, or many HTTPS sites fail on this PC only.

A program or device that inspects HTTPS sits in the middle of the handshake and answers in the site's place. Cloudflare documents that such middleboxes can fail with TLS 1.3, and Chromium's code notes firewalls that block a page with an alert Chrome reports as this error.

1. If a VPN is connected, disconnect it and reload the page. If the VPN was off, skip this step.
2. In Chrome, select More (the three dots), then Settings, then System.
3. Select Open your computer's proxy settings. Windows opens its proxy page.
4. Check whether a proxy server is set that you did not set up yourself. On a work or school PC, do not change it: ask the administrator.
5. Open your security program and find its web protection settings. Google's help calls the feature "HTTPS protection" or "HTTPS scanning". The name differs between products.
6. Turn that one feature off, reload the page, and turn the feature back on right away.
7. If the page loaded with the feature off, update the security program to its latest version and test again with the feature on.
8. Restart the router and the modem, then test once more. Google lists this for connection errors that affect several sites.

• Works with the VPN off: the VPN's servers or its own filtering break the handshake. Change the VPN server or protocol, or report the address to the VPN's support.
• Works with HTTPS scanning off: Cloudflare's advice is to update the security software to a version that supports TLS 1.3. Most products also let you exclude one site from scanning.
• Fails on your whole network for one site only: a content filter, parental control or the provider blocks that site. Cloudflare notes that some providers switch such features off on request or add a domain to an allowlist.
• A work, school or public network: the filter is a rule of that network. The person who runs it decides, and no setting on your PC changes it.

How to pause Microsoft Defender's real-time protection for a single test, and why it turns itself back on, is shown here: Turn off Microsoft Defender protection for a moment. Use it only if Defender is your one security program and the steps above pointed at this PC.

Fix 4. Test an Incognito window, turn off extensions and update Chrome

5 to 10 minutesLow riskThe site opens in another browser on the same PC, or Fix 3 found nothing.

These are steps 3 to 5 of Google's own list for connection errors. An extension that filters or reroutes traffic can break a handshake, and an outdated Chrome can lack what a current server expects. Incognito separates the profile from the rest in one step.

1. Press Ctrl + Shift + N to open an Incognito window and open the address there.
2. If the page loads, close the Incognito window and select More, then Extensions, then Manage extensions.
3. Turn every extension off with its switch and load the page in a normal window.
4. Turn the extensions on one at a time until the error returns. Google recommends exactly this order.
5. Select Remove on the extension that brings the error back, or leave it switched off.
6. Select More, then Help, then About Google Chrome. Chrome checks for an update on this page.
7. Select Relaunch if the button appears, then test the address again.

• The error is the same in Incognito: the profile is not the cause. Do not remove extensions or reset Chrome. Go back to the table in Fix 1.
• VPN, ad blocking and antivirus extensions are the ones to suspect first, because they handle every connection.
• Chrome reports that it is up to date and the error stays: the version is not the cause either.

Fix 5. Turn off QUIC as a test

2 minutesLow riskThe error comes and goes on sites that otherwise work, above all on a company, hotel or mobile network.

Cloudflare writes that intermittent SSL protocol errors can come from HTTP/3, which runs over QUIC on UDP port 443, on networks that do not fully support it. With the flag off Chrome uses HTTP/2 over TCP, so the test shows whether QUIC is involved.

1. Type chrome://flags/#enable-quic in the address bar and press Enter.
2. Find Experimental QUIC protocol at the top of the list, highlighted in yellow.
3. Open the menu on its right and select Disabled.
4. Select Relaunch at the bottom of the window. Chrome restarts with your tabs.
5. Open the site several times, the way that used to bring the error.
6. Afterwards, go back to the flag and set it to Default, unless the test changed the result.

Fix 6. Fix "localhost sent an invalid response" on a development server

5 to 15 minutesLow riskYou run a site on your own PC and Chrome shows the error for localhost, 127.0.0.1 or a local test name.

Development servers start with plain HTTP unless HTTPS is switched on. Angular's ssl option, for example, is false by default. An https://localhost address then reaches an HTTP port, the server answers in text, and Chrome reports an invalid response.

1. Read what the server printed when it started. It names the address it listens on, with http:// or https:// and a port.
2. Open exactly that address. If it says http://localhost:4200, type http:// in full, so the address is exactly the one the server printed.
3. If the project has two ports, one for HTTP and one for HTTPS, make sure https:// goes with the HTTPS port. In ASP.NET Core development these are typically 5000 and 5001.
4. If you need HTTPS locally, switch it on in the server with one of the options in the table below and start the server again.
5. If Chrome keeps turning a local test name into https://, open chrome://net-internals/#hsts.
6. Under Delete domain security policies, type the host name and select Delete.
7. Close the tab, open a new one and load the address again.

Commands named above

ng serve --ssl
dotnet dev-certs https --trust

• HSTS and plain localhost. A site can tell the browser to use HTTPS only, and Chrome remembers it. Chromium's current code ignores such headers for localhost names, so a stored entry is a likely cause only for other local names you made up.
• Preloaded names cannot be deleted. The delete form says so itself: it removes the dynamic policy of a domain, not entries from Chrome's built-in list.
• A self-signed certificate is a different page. Once the server really speaks HTTPS, an untrusted certificate gives "Your connection is not private", not this error. Microsoft describes that warning for its development certificate.
• A reverse proxy in front. If nginx or another proxy forwards to your app, the same rule applies to each hop: the address and the port must agree on HTTP or HTTPS.

Fix 7. On your own website: make port 443 answer with TLS

15 to 30 minutesLow riskThe site is yours and visitors report the error, or it fails on every network in Fix 1.

If the error appears for everyone, the server or the service in front of it sends the invalid response. The usual reasons are a port 443 without TLS switched on, a certificate that is not active yet, or a TLS setup that breaks the handshake.

1. Test the port from outside your own network with the two commands below. Replace example.com with your domain.
2. Read the output of openssl s_client. A working server prints a certificate chain. If none appears, the port did not answer with TLS.
3. On nginx, check that the listening socket has the ssl parameter and that the certificate and key are set, as in the example below.
4. On Apache, check that the virtual host for port 443 contains SSLEngine on and both certificate lines. The engine is disabled by default.
5. Offer TLS 1.2 and TLS 1.3. Chrome's default range is exactly these two versions.
6. If a CDN or proxy stands in front of the server, check that its certificate for your domain is active.
7. Reload the web server and run the two commands again. Then open the site in Chrome on mobile data.

Test the HTTPS port (commands from Apache's SSL documentation)

curl https://example.com/
openssl s_client -connect example.com:443 -state -debug

nginx: an HTTPS server block, as in the nginx documentation

server {
    listen              443 ssl;
    server_name         www.example.com;
    ssl_certificate     www.example.com.crt;
    ssl_certificate_key www.example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
}

Apache: the lines the virtual host for port 443 needs

<VirtualHost _default_:443>
    SSLEngine on
    SSLCertificateFile    "/path/to/this/server.crt"
    SSLCertificateKeyFile "/path/to/this/server.key"
</VirtualHost>

Fix 8. Delete Chrome's browsing data and read the hosts file

5 to 10 minutesLow riskOnly this PC fails, also after Fix 3 and Fix 4, or the site fails in every browser on this PC and works on other devices.

Deleting browsing data is step 6 of Google's list for connection errors. The hosts file can send a site's name to another address, and Microsoft notes that a changed hosts file overrides normal name lookup and can cause problems reaching websites.

1. Open Delete browsing data. Press Ctrl + Shift + Delete. Or select More (the three dots at the top right) > Delete browsing data.
2. Choose how far back to delete. Select a time range at the top, such as Last hour. To clear everything, open More next to the ranges and choose All time.
3. Choose what to delete. Check Cached images and files. Check Cookies and other site data too if a site will not sign you in. Uncheck anything you want to keep.

   

4. Delete the data. Select Delete from this device.

These steps were written for Chrome for Windows (screenshot: Windows 11 26H2). The full page with the other versions and what each result means: Clear the browser cache and cookies

1. Press Win + R, type %WinDir%\System32\Drivers\Etc and press Enter. The folder is typically C:\Windows\System32\drivers\etc.
2. Right-click the file hosts, select Open with and choose Notepad.
3. Read the lines that do not start with #. A default hosts file has none: every line in it is a comment.
4. Look for a line that contains the name of the site that fails.
5. If you find one that you did not add yourself, restore the default file with the steps of Microsoft's article in the sources. It keeps the old file as a backup.
6. Close Chrome completely, open it again and load the site.

If the error is still there: record what Chrome received

When no test points anywhere, let Chrome write down the handshake. Chromium's instructions for network problems use a built-in recorder. For a failed handshake the file holds an event named SSL_HANDSHAKE_ERROR with the fields net_error, ssl_error, error_lib and error_reason. The last two are the exact reason from Chrome's TLS library, which the error page hides.

1. Open a new tab and go to chrome://net-export/.
2. Select Start Logging to Disk and choose where to save the file. Leave the options as they are.
3. Load the failing address in a different tab. The recorder tab must stay open, or logging stops.
4. Go back to the recorder tab and select Stop Logging.
5. Send the whole file. The Chromium team says that snippets are rarely sufficient.

• What to send to the website: the exact address, the date and time, the full error text and your Chrome version from Help > About Google Chrome. Add your Windows version, the name of your security software, and whether you use a VPN, a proxy or a company network. This is the list Cloudflare asks site owners to collect.
• For a site behind Cloudflare: open https:// plus the domain plus /cdn-cgi/trace and add the text it shows. Cloudflare names this as its diagnostic data.
• When it is not your PC: the site fails on mobile data, on other devices and in other browsers. Google's help says the same in one sentence: contact the website owner.
• When it is the network's rule: one site fails on one network and works elsewhere. A filter at work, at school, on a parental control or at the provider decides that, and only its owner can change it.
• When it is a different problem: several sites fail with several codes. Start with How to check your internet connection in Windows, and use Reset the network and flush DNS only if that page points at Windows.

We found no Google page that offers a setting to switch this error off, and Chrome gives no Proceed link on this page. That is by design: without a completed handshake there is no encrypted connection to proceed with.

How to keep ERR_SSL_PROTOCOL_ERROR from coming back

Most of this error is outside your control, because the invalid response is written by a server or a network device. What you control is the two-minute test that shows where it comes from, and the address you type for the devices and servers that are your own.

Frequently asked questions

What does "sent an invalid response" ERR_SSL_PROTOCOL_ERROR mean in Chrome?

It means the TLS handshake with that address failed: Chrome asked for an encrypted connection and what came back was not a valid TLS answer. Chromium lists the code as network error -107, "An SSL protocol error occurred", and shows it under the heading This site can't provide a secure connection. The site name in the sentence is the host you typed, not proof of who sent the bad answer. It can be the website's server, a filter or firewall on the way, a security program on the PC, or a port that only speaks plain HTTP.

Is the website hacked, or is my Chrome broken?

Usually neither. The error says that no encrypted connection could be built, so no page content reached your browser at all. A site that worked yesterday and fails today has most often had its server or certificate setup changed, or your network has started to filter it. Test the address on mobile data. If it fails there too, the site's owner has to repair it and nothing on your PC is wrong. If it loads there, something on your network or PC interferes, and Fix 3 finds it.

Why do I get ERR_SSL_PROTOCOL_ERROR on one particular site only, for example an adult or streaming site?

When a single site fails on your connection and opens on another one, a filter is the likely reason. Cloudflare lists parental controls, content filters and inspection by the internet provider among the things that interfere with HTTPS connections to certain sites. Chromium's code also mentions firewalls that block a page with a TLS alert, which Chrome reports as this error. Such a block is set by whoever runs the network: a provider, an employer, a school or a parent. No Chrome setting removes it. This page explains the error for any site name that appears in the message.

Why does Chrome say "localhost sent an invalid response"?

Because the address starts with https:// and the local server on that port answers in plain HTTP. Development servers do not use HTTPS unless you switch it on. Angular's ssl option is false by default, for example. Type http://localhost with the port the server printed when it started. If you need HTTPS, enable it in the server: ng serve --ssl for Angular, server.https for Vite, or dotnet dev-certs https --trust and the HTTPS port for ASP.NET Core. A self-signed certificate then gives a certificate warning, which is a different and expected page.

How do I fix ERR_SSL_PROTOCOL_ERROR on an Android phone or an iPhone?

Start with the same test as on a PC: switch between Wi-Fi and mobile data and open the address again. If it works on one of them, the other network filters or breaks the connection. If it fails on both, the website has to be repaired by its owner. Google's help page for connection errors has its own tabs for Android and for iPhone and iPad, next to the one for computers. Turn off a VPN or a security app for one test and turn it back on. The detailed steps on this page are written for Chrome on Windows.

Does clearing the SSL state in Windows fix ERR_SSL_PROTOCOL_ERROR?

We could not confirm that it does. The Clear SSL state button belongs to Internet Options in Windows. Chrome negotiates TLS with its own library, as the error mapping in Chromium's source code shows, and Google's help pages for Chrome errors do not mention the button. Pressing it does no harm, but it is not a fix we can point to a source for. The same goes for the TLS version boxes in Internet Options: Chromium's code sets its own range, TLS 1.2 to TLS 1.3.

Can a wrong date and time on the PC cause this error?

No. A wrong clock makes certificates look expired or not yet valid, and Chrome has its own page for that. Google's help describes it with the titles Your clock is behind and Your clock is ahead and the code NET::ERR_CERT_DATE_INVALID. That check happens after a handshake has worked. ERR_SSL_PROTOCOL_ERROR means the handshake itself failed, so correcting the clock does not change it. If you do see the clock page, set the time automatically in Windows Settings and reload.

Is it safe to open the site with http:// instead of https://?

For a device on your own network, such as a router, a printer or a development server, yes. Many of them serve their pages over plain HTTP by design. For a public website it is only safe to read. An http:// connection is not encrypted, and Chrome marks it Not Secure. Do not sign in, pay or enter personal data that way. A public site whose HTTPS is broken should be reported to its owner and used again when it is repaired.

Which TLS versions does Chrome accept, and can an old server cause this error?

Chromium's source sets the default range to TLS 1.2 as the minimum and TLS 1.3 as the maximum. The policy that once allowed TLS 1.0 and 1.1 lost those values in Chrome 91. A server that offers only the old versions does not produce ERR_SSL_PROTOCOL_ERROR, though. Chromium maps that refusal to ERR_SSL_VERSION_OR_CIPHER_MISMATCH, and the page says the site uses an unsupported protocol. Google advises site owners to offer TLS 1.3 and to keep TLS 1.2 for older clients.

How do I disable the ERR_SSL_PROTOCOL_ERROR check in Chrome?

You cannot, and there is nothing to switch off. The message is not a warning that Chrome places in front of a working connection. It reports that no encrypted connection exists, because the handshake failed. That is why the page has a Reload button and no link to continue. The only way around it is a connection that works: another network if yours interferes, http:// for your own devices, or a repaired server. Flags and settings that claim to bypass it do not apply to this code.