How to fix SSL_ERROR_HANDSHAKE_FAILURE_ALERT error in Windows?

SSL_ERROR_HANDSHAKE_FAILURE_ALERT is a Firefox error code: the website, or a device between you and it, refused to agree on how to encrypt the connection. Most often the site wants a login certificate, or a VPN, proxy or HTTPS scanning breaks the handshake. Open the address on mobile data and in another browser first to see where the fault is.

Facts checked on 15 October 2026. Steps written for Firefox on Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What SSL_ERROR_HANDSHAKE_FAILURE_ALERT means

Before an https:// page loads, the browser and the server run a TLS handshake. Firefox sends a hello that lists the TLS versions and ciphers it can use. The server picks one of each and, on some sites, asks the browser for a login certificate. If the server cannot accept anything Firefox offered, it sends back a short message called an alert, and the alert's name here is handshake_failure.

Mozilla's NSS library, which does the encryption inside Firefox, turns that alert into the code SSL_ERROR_HANDSHAKE_FAILURE_ALERT, number -12227. Its official text is "SSL peer was unable to negotiate an acceptable set of security parameters." The peer is the other side of the connection. So the code does not say that Firefox broke: it says the other side said no.

What causes SSL_ERROR_HANDSHAKE_FAILURE_ALERT, from most to least likely

Google's first page for this code is a list of company and university portals that sign people in with a certificate, which matches the most common cause. Next come networks and programs that sit in the middle of HTTPS traffic, which Mozilla names for every secure connection failure. A Firefox with changed TLS preferences and an outdated server are the rarer cases.

Similar Firefox SSL error codes and how they differ

Firefox has a whole family of codes that end in _ALERT. Each one names the alert the other side sent, so the name already points at the cause. The descriptions below are Mozilla's own texts from the NSS error list.

How to fix SSL_ERROR_HANDSHAKE_FAILURE_ALERT

Fix 1 is a two minute test that tells you whether to work on your PC or leave the repair to the site. Fix 2 is for sites that sign you in with a certificate. Fixes 3 to 6 are for a PC or network that breaks the handshake, and Fix 7 is for website owners.

Fix 1. Open the site on another network, device and browser

2 minutesNo riskYou see the error and want to know whose fault it is before changing anything.

The error page cannot tell whether the server or something in the middle sent the alert. Mozilla's own advice for a problem with the website is to try it in another browser, and another network separates your connection from the site.

1. Select Try Again on the error page once, and check the address for typing mistakes.
2. Open another HTTPS site in a new tab. Note whether one site fails or many.
3. Open the same address in Microsoft Edge on the same PC.
4. On a phone, turn off Wi-Fi so it uses mobile data, and open the address there.
5. If you use a VPN, disconnect it and select Try Again in Firefox.
6. Read your result in the table below and go to the fix it names.

Fix 2. Give Firefox the login certificate the site asks for

5 to 10 minutesLow riskThe site is a company, university, bank, tax or government portal that signs people in with a certificate or a smart card.

A server that requires a client certificate ends the handshake when the browser sends none. Firefox keeps its own certificate store, separate from Windows, so a certificate that works in Edge may still be missing in Firefox.

1. Find the certificate file your organization gave you, usually a .p12 or .pfx file, and its password.
2. In Firefox, open the menu (three lines at the top right) and select Settings.
3. Select Privacy & Security on the left and scroll down to Certificates.
4. Select View Certificates and open the Your Certificates tab.
5. Select Import, choose the file and enter its password.
6. For a smart card or token, select Security Devices in the same section and load the module your organization names.
7. Close Firefox completely, open it again and load the site. Pick the certificate when Firefox asks.

• The certificate is in Windows only. If Edge signs you in, the certificate sits in the Windows store. Export it from there with its private key, or ask your IT team for a file, and import it into Firefox.
• Firefox did not ask which certificate to use. Then it found none that the site accepts. Check that the certificate has not expired and was issued for this portal.
• The certificate was read and refused. That gives a different code, SSL_ERROR_ACCESS_DENIED_ALERT. Only the site's support can change it.

Fix 3. Rule out the VPN, the proxy, DNS over HTTPS and HTTPS scanning

10 to 20 minutesLow riskThe site opens on another network or device, or several HTTPS sites fail on this PC.

Mozilla lists VPN software, DNS over HTTPS, antivirus that scans encrypted traffic, proxy settings and firewalls as the usual reasons a secure connection fails. Each of them can answer Firefox's hello in the site's place and refuse it.

1. Disconnect the VPN, if one is on, and select Try Again.
2. In Firefox, open Settings, stay on General, scroll to Network Settings and select Settings.
3. Check which proxy option is selected. If a manual proxy is set that you did not set up, choose Use system proxy settings. On a work PC, ask the administrator first.
4. Open Settings > Privacy & Security and scroll to DNS over HTTPS. Set it to Off for one test, or add the site to Exceptions.
5. Open your antivirus and find the HTTPS or encrypted connection scanning setting. Turn it off, reload the page and turn it back on at once.
6. If the page loaded with scanning off, update the antivirus to its latest version and test again with scanning on.
7. Set DNS over HTTPS back to the level you had, unless the test showed it was the cause.

How to pause Microsoft Defender for a single test and switch it back on: Turn off Microsoft Defender protection for a moment. On a company network, a firewall that inspects HTTPS is the network's rule, and only its administrator can change it.

Fix 4. Reset changed TLS settings in about:config

5 minutesLow riskThe site opens in Edge or Chrome on this PC, but Firefox shows the error.

Guides and tools sometimes tell people to change Firefox's TLS version range or switch off ciphers. If Firefox then offers nothing the server accepts, the server answers with exactly this alert.

1. Type about:config in the address bar and press Enter.
2. Select Accept the Risk and Continue on the warning page.
3. Type security.tls.version in the search box.
4. Look for lines in bold: those were changed from the default. Select the reset arrow at the end of each bold line.
5. Search for security.ssl3 and reset any bold line there too. These switch single ciphers on and off.
6. Close the tab, close Firefox completely, open it again and load the site.

Fix 5. Update Firefox and delete its cached data

5 minutesLow riskFirefox has not updated for a while, or the error started on a site that used to work in Firefox.

An old Firefox may lack the ciphers a current server requires. Mozilla also notes that Firefox can keep an outdated certificate, and clearing stored site data removes old connection details for that site.

1. Open the menu (three lines), select Help and then About Firefox.
2. Wait while Firefox checks for updates and downloads one.
3. Select Restart to update Firefox if the button appears.
4. Clear the cache for the site with the steps below. Start with the cache only.

1. Open Clear browsing data and cookies. Press Ctrl + Shift + Delete. Or open the menu (three lines) > Settings > Privacy & Security and select the clear button in the section for cookies and browsing data.
2. Choose how far back to delete. Next to When:, choose a range. Choose Everything to clear the whole cache.
3. Choose what to delete. Check Temporary cached files and pages. Check Cookies and site data too if a site will not sign you in. Uncheck the rest if you want to keep it.

   

4. Delete the data. Click Clear.

These steps were written for Firefox for Windows (screenshot: Windows 11 26H2). The full page with the other versions and what each result means: Clear the browser cache and cookies

Step by step for every browser: Clear the browser cache and cookies. If the site uses a certificate you added yourself, open Settings > Privacy & Security > Certificates > View Certificates, select the outdated one and select Delete or Distrust, as Mozilla describes.

Fix 6. Test in Troubleshoot Mode, then refresh Firefox

10 minutesRead the warningOnly Firefox fails on this PC, and Fixes 4 and 5 did not help.

Troubleshoot Mode starts Firefox without extensions and with default settings for one session. If the site opens there, something in your profile refuses or rewrites the handshake, and a refresh builds a clean profile.

1. Open the menu (three lines), select Help and then Troubleshoot Mode.
2. Select Restart, then Open in the small window.
3. Load the site. If it opens, the cause is an extension or a setting in your profile.
4. Restart Firefox normally, open Add-ons and themes with Ctrl + Shift + A and switch extensions off one by one until the site loads.
5. If no extension is the cause, type about:support and select Refresh Firefox, then confirm.

Fix 7. On your own website: accept current TLS and set client certificates right

15 to 30 minutesLow riskThe site is yours, and visitors with Firefox report the error, or it fails everywhere in Fix 1.

When every visitor fails, the server sends the alert. It cannot agree on a version or cipher with a current Firefox, or it requires a client certificate that ordinary visitors do not have.

1. Test the site with the SSL Labs server test, which Mozilla's help names for site owners, and read the protocol and cipher lists.
2. Make sure the server offers TLS 1.2 and TLS 1.3 with current ciphers. Firefox's default range is exactly these two versions.
3. Run the command below from a PC outside your network and check that a certificate chain is printed.
4. If the site should not ask every visitor for a certificate, make client authentication optional or limit it to the sign-in path.
5. Check that the server has a certificate for every name visitors use, with and without www.
6. Fix any "Chain issues: Incomplete" result in the test, then reload the server and test again in Firefox.

Check the handshake from outside (replace example.com)

openssl s_client -connect example.com:443 -servername example.com

If the error is still there: what to check and what to send

Mozilla's page for this kind of error says plainly that there is no option to add a security exception, and it asks you to contact the website owners. Without a finished handshake there is no encrypted connection to continue on, so no setting in Firefox removes the message on a site that refuses everyone.

• What to send to the website: the exact address, the date and time, the full error text and your Firefox version from Help > About Firefox. Add your Windows version, your security software, and whether you use a VPN, a proxy or a company network.
• When it is not your PC: the site fails on mobile data, on other devices and in other browsers. Only the owner can repair the server.
• When it is the network's rule: one site fails on one network and works elsewhere. A filter at work, at school or at the provider decides that.
• When it is a certificate portal: your organization's IT or the portal's helpdesk can check whether your certificate is valid and issued for this site.
• When many sites fail with many codes: start with How to check your internet connection in Windows, and use Reset the network and flush DNS only if that page points at Windows.

How to keep SSL_ERROR_HANDSHAKE_FAILURE_ALERT from coming back

Most of this error is decided outside your PC, by the server or by a device on the way. What you control is the two minute test that shows where the refusal comes from, the certificate your organization gave you, and Firefox's settings left at their defaults.

Frequently asked questions

What does error code SSL_ERROR_HANDSHAKE_FAILURE_ALERT mean?

It means the other side of the connection refused the TLS handshake. Firefox offered its TLS versions and ciphers, and the server, or a filter or VPN in the middle, answered with an alert called handshake_failure. Mozilla's NSS library lists the code as -12227 with the text "SSL peer was unable to negotiate an acceptable set of security parameters." The most common reason is a site that wants a login certificate. Other reasons are a program that intercepts HTTPS, changed Firefox TLS settings, or a server with an outdated setup.

Why do I see SSL_ERROR_HANDSHAKE_FAILURE_ALERT in Chrome?

You almost certainly do not: Chrome and Edge do not use this code. It is a name from Mozilla's NSS library, so the page was opened in Firefox or a browser built on it. Chrome shows its own codes for the same refusal, for example ERR_BAD_SSL_CLIENT_AUTH_CERT when a site wants a login certificate, or ERR_SSL_VERSION_OR_CIPHER_MISMATCH when there is no common cipher. If Chrome shows "sent an invalid response", read our guide to ERR_SSL_PROTOCOL_ERROR.

How do I fix SSL_ERROR_HANDSHAKE_FAILURE_ALERT in Firefox?

First find out where the refusal comes from. Open the address on mobile data and in Edge. If the site is a work, school, bank or government portal, import your login certificate under Settings, Privacy & Security, Certificates, View Certificates, Your Certificates. If it opens on another network or with the VPN off, check the VPN, the proxy, DNS over HTTPS and HTTPS scanning. If it opens in Edge only, reset bold TLS lines in about:config, update Firefox and test Troubleshoot Mode. If it fails everywhere, tell the site's owner.

Can I bypass SSL_ERROR_HANDSHAKE_FAILURE_ALERT and open the site anyway?

No. Mozilla's help says there is no option to add a security exception for a Secure Connection Failed page. The page is not a warning placed in front of a working connection: the handshake did not finish, so no encrypted connection exists to continue on. You need a connection that works: the right login certificate, another network if yours interferes, or a server fixed by its owner. Lowering Firefox's TLS settings to force a connection weakens your security and usually does not help with this alert.

Why does the error come and go on the same site?

A server that refuses the handshake usually refuses it every time, for everyone. An error that appears on some loads only points at something in the middle. A VPN that switches servers, a security program that scans some connections, a busy company firewall or a provider filter can all behave this way. Disconnect the VPN and test on mobile data a few times. If the error never appears there, work through Fix 3 on your own network and programs.

Does a wrong date and time on the PC cause this error?

Not this one. Mozilla's help says an incorrect system clock makes Firefox treat a website's certificate as expired or invalid, and Firefox shows that on a Warning: Potential Security Risk Ahead page with time related codes. SSL_ERROR_HANDSHAKE_FAILURE_ALERT comes from the other side refusing the handshake, before any certificate date is judged. If you do see a time related warning, set the clock to update automatically in Windows and reload the page.

Do the TLS boxes in Windows Internet Options fix this error?

Not for Firefox. Firefox encrypts connections with Mozilla's own NSS library and keeps its own certificate store and TLS settings. The Use TLS 1.2 and Use TLS 1.3 boxes in Windows Internet Options belong to Windows' own security components, which Firefox does not use for its connections. Firefox's version range is set in about:config, and its defaults are TLS 1.2 and TLS 1.3. Leave the Windows boxes as they are, and use Fix 4 if Firefox's settings were changed.

What is the difference between SSL_ERROR_HANDSHAKE_FAILURE_ALERT and SSL_ERROR_NO_CYPHER_OVERLAP?

Both say the two sides found no common ground, but they come from different sides. SSL_ERROR_NO_CYPHER_OVERLAP is Firefox's own finding: "no common encryption algorithm(s)". SSL_ERROR_HANDSHAKE_FAILURE_ALERT is the server's refusal, sent as an alert, and it can also mean the server wanted a login certificate. For both, reset changed TLS settings in Firefox first. If Firefox runs with default settings, the server's cipher list needs to be updated by its owner.

I see "SSL handshake failed" in another app, such as a download manager. Is it the same error?

It is the same kind of failure but not the same code. Download managers, game launchers and scripts use their own TLS libraries and write their own messages, such as SSL handshake failed or a Python SSLError. The checks that do not depend on Firefox still apply: test another network, disconnect the VPN, test the antivirus's HTTPS scanning for one page load, and update the app. This page covers the Firefox code and its fixes.

What does خطای ssl_error_handshake_failure_alert mean?

It is the same Firefox error written with the Persian word for error. Google sends searches in other languages to this English page. The meaning does not change with the language: the website, or something between you and it, refused the secure handshake. The steps above work the same in Firefox in any language, though menu names are translated. Start with Fix 1, which needs no menus: open the address on mobile data and in another browser to see where the fault is.