You click a link, a flicker of a page, then suddenly Chrome slams the door in your face with a big red warning. Not the page you wanted, not a login or checkout or whatever… just a notice that says we are not so sure about this site at the moment.
I got this error three times in one month alone when testing browser extensions on various networks, and each caused a different issue. That‘s what makes this error so frustrating: There isn‘t a single solution, because the error takes the fall for multiple different issues.
Here‘s how to resolve this site can‘t provide a secure connection, from both ends: what you can do first as a visitor over the next 5 minutes, plus what the owner of the site should look into if the error is occuring with their own domain. Then read on for the Android and iPhone-specific things to look into since on those the steps are different than in Chrome on the desktop.
Table of Contents
What Does “This Site Can’t Provide a Secure Connection” Mean?
What does it really mean? It means that your browser attempted to establish (handshake) a secure or encrypted link with the server and the handshake failed. Browsers will not display a page using HTTPS unless the server presented a valid certificate and the two ends agreed on a supported encryption algorithm.
When that fails say the cert is absent, expired, or the server is only running old protocols Chrome won‘t go any further. It‘s not being a drama queen. It‘s just doing its job: preventing a connection that can‘t be authenticated.
You will typically find about a dozen of these types of error codes on the bottom of the main message, and the actual code is more helpful than the generic headline in diagnostic.
Why Does Chrome Show “This Site Can’t Provide a Secure Connection”?
A few things trigger this on the browser side, and it‘s rarely just one:
- The site‘s SSL/TLS certificate expired or is not present or not valid exactly for the domain you‘re visiting.
- The server only provides deprecated, no longer supported protocols such as TLSv1.0 or 1.1, which modern day Chrome browsers will no longer allow.
- The clock on your machine is incorrect. This causes the browser to treat a valid certificate as expired or not yet active.
- The Kerberos handshake is being broken by a VPN, an anti virus or corporate proxy intercepting the traffic.
- Stale SSL data. Any of the SSL data cached locally from before the certificate was changed.
During testing I realized, much to my surprise that the culprit was clock drift far more frequently than I would have thought particularly on older laptops and computing devices that had been asleep for extended periods of time and had not gotten the correct time synchronized. This is a familiar five second check that is always ignored.
How to Fix “This Site Can’t Provide a Secure Connection”
Work through these in nearly the order given. Most people get it after the four or five.
Check Your Internet Connection rule first. If you have a poor or intermittant connection, the handshake can be dropped while it is occurring causing this error, despite the certificate performing correctly.
Reload the website This is not a difficult thing to do, just reload your page with a hard refresh (PC: Ctrl+Shift+R; Mac: Cmd+Shift+R) and it will old the cached version of the page and try the handshake again.
Makesurethedate and time is accurate on your Computer Head into your system clock options and verify the date,time andtimezoneis accurate and turn theautomaticsyncif not already enabled. This alone fixed the error for me in 1 of the 3 cases I encountered it.
Clear Chrome Cache and Cookies Chrome Settings > Privacy and Security > Clear Browsing Data. Aha! Here is where cached images/files and cookies hide. Sometimes a browser is still holding stale SSL state here even after the site has changed the SSL certificate.
Let‘ssee Incognito Mode Try opening the site in an incognito window. If it works smoothly in that case then it‘s a cookie saved on your regular profile or a browser extension creating the problem and not a bug of the site.
Disable Browser Extensions Ad blockers, VPN extensions, and privacy tools can occasionally break the certificate verification. Disable them temporarily one by one (chrome://extensions) and refresh/reload the page until able to proceed.
Update Google Chrome Head over to Settings → About Chrome and let it update. Outdated browser builds may not contain the modern TLS settings newer websites need.
ResetyourrouterAsimple restart of your router will sometimes do a quick clear of any DNS caching problems at the router level, which will take care of any occasional handshake failures related to your local network.
Flush DNS Cache On Windows, launch cmd and type ipconfig /flushdns. On Mac, type sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder. This will delete any old DNS entries that could be leading your browser to the wrong place.
Switch DNS from your normal ISP DNS to one like 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google) it is configured in your network adapter settings. There are some ISPs DNS server which have poor domain handling ability.
Disable your VPN or proxyVPNor proxy use an intermediate station to route your traffic. Sometimes it can‘t properly pass the site certificate back to you. Disable it and try to load it again.
Verifythe Antivirus &firewallconfiguration some antivirus suits have an “HTTS inspection” inside, which analyzes the crackling traffic by replacing the original certificate. This is a very common reason of certificate mis-match error try turn it off for an hour and see if it helps.
How to Fix “This Site Can’t Provide a Secure Connection” in Chrome
In addition to the above general measures, Chrome also has a few specific options worth looking at. Navigate to chrome://flags/#enable-quic and change the setting to Disabled and restart. Some networks have been known to have QUIC, an experimental protocol that can occasionally get in the way of a normal TLS handshake, disabled silently fixed this error for a lot of users with the problem on the forums.
Another way to see if the domain is in an HSTS (HTTP Strict Transport Security) state that forces HTTPS on it for anything that‘s misconfigured, you can load chrome://net-internals/#hsts, but this is a more advanced step to take and may be best suited for ongoing problems.
How to Fix “This Site Can’t Provide a Secure Connection” on Windows
On Windows particularly, you might try clearing the SSL state at the system level (rather than just the Chrome cache) as Windows has its own certificate store that Chrome has to partially use. Under Control Panel → Internet Options → Content tab → Clear SSL State and then reboot your browser.
Another thing to look at is Windows Update. The list of trusted certificates is updated periodically by Windows Update, and an out of date operating system might be denying certificates it actually should trust.
How to Fix the Error on Android
First, on Android, it’s best to ensure the date/time are set to automatic, clear Chrome‘s cache by navigating to Settings→ Apps→ Chrome→ Storage→ Clear Cache not ‘Clear Data,’ which would wipe out saved logins as well. And ensure whether a VPN app is running in the background this is often an Android-specific root of the issue.
How to Fix the Error on iPhone
On iPhone, open Settings → General → Date & Time and ensure “Set Automatically” is enabled. After that navigate to Settings → Safari → Clear History and Website Data. Also, if you are using a VPN profile or a profile configuration from your work, you can try turning it off in Settings → VPN & Device Management, since installed profiles may provide their own root certificates that may be issuing a conflicting cert by the site.
How to Fix “This Site Can’t Provide a Secure Connection” for Your Own Website
If it‘s your site causing the error to visitors then your fix list will not match I suggest you begin by ensuring that your certificate is present and enabled (not expired. Present. For the right hostname (including any subdomains that you receive traffic on).
- Force all HTTP traffic to redirect to HTTPS at the server or CDN level.
- Set ‘Enable TLS 1.2’ and ‘Enable TLS 1.3’ toenabled’, and set ‘Disable TLS 1.0/1.1’ and ‘Disable all weak ciphers (eg RC4, 3DES, etc.)’ toenabled
- If you are using Cloudflare or another CDN, verify that the Edge Certificate is enabled, the DNS record is proxied, and if you have any deep subdomains under the domain, then it falls under the Total TLS or similar plan.
- Test using real hostname and not server IP address, as in case of shared hosting Server is identified using SNI.
Through diagnostic work on a small selection of client sites, I learned that more of these incidents are caused by CDN-layer misconfiguration than expired certificates and that a valid certificate at the origin can still result in the edge serving up a stale one. If you keep an eye on renewal reminders from your CA in the meantime, an always available Gmail Search Operator newer_than filter can pull the recent reminder email without you first having to manually search through your inbox.
Check the Website’s SSL Certificate
Before assuming something‘s broken, verify the certificate yourself. Services such as SSL Labs provide a free tool which will analyze any domain and provide a detailed view of the certificate chain, supported protocols, and any problems. If you prefer manual testing, run:
openssl s_client -connect example.com:443 -servername example.comThis presents precisely what certificate the server is giving and allows you to verify if it‘s the one you‘re testing.
Common SSL Errors Behind This Message
More often than not, the overall error page conceals a more explicit code. Once you are aware of which, you greatly reduce the potential reasons for this occurrence:
- ERR_SSL_PROTOCOL_ERROR – Typically a simple mismatch in the way the browser and server are attempting to establish a connection.
- ERR_SSL_VERSION_OR_CIPHER_MISMATCH – The server will only negotiate SSL versions or cipher suites which have been deprecated by the browsers you are currently using.
- ERR_CERT_COMMON_NAME_INVALID The domain being visited is not covered by the certificate (either the exact domain or one of its subdomains)
- ERR_CERT_DATE_INVALID – The certificate has expired or there is a problem with your computer’s system date and time.
- ERR_SSL_HANDSHAKE_FAILURE, the failure is more generic during the negotiation stage and may be due to server misconfiguration.
What to Do if the Error Happens Only on One Website
Should this occur on only one site it is highly likely that the issue is at that sites end, with an expired or misconfigured certificate probably to blame. You can do little, other than wait for the site owner to correct the issue, however it‘s worth clearing your SSL cache in case your browser has an old certificate stored from prior to renewal.
What to Do if the Error Happens on Every Website
In this sort of situation, where it‘s happening on every HTTPS site you go to, it‘s almost definitely a local problem: a wrong date/time on your system, an antivirus program that is hijacking connections, an unruly VPN, or a damaged certificate store on your device. Tackle the general fix steps above beginning with the date/time verification, as that‘s responsible for a hefty percentage of “every site is broken” feedback.
Is It Safe to Visit a Website With This Error?
No — please don‘t just click through and continue, even if Chrome provides you with an “Advanced” link that lets you continue. That warning appears because the browser is actually unable to verify that the site is whom it claims to be. As a result, any information you put in (passwords, credit card information, personal details, etc.) can be compromised by an attacker lurking in the middle of the connection. If it really is that important you should contact the owner of the site directly rather than just ignoring the error.
Frequently Asked Questions
Will a cache flushwith Chrome clear this error?
Maybe, not. Only if the stale SSL state is the root of the problem: if the certificate is expired or corrupted, flushing your cache won‘t solve anything.
Is this always theresultof an expired certificate?
No, other causes are unsupported TLS versions, missing domain coverage on the cert, incomplete chain, or local problems such as clock drift and vpn.
If I access the site using the domain name,itworks.If I use theip address, it doesn‘t. Shared hosting servers use SNI (Server Name Indication) to offer the right certificate for the right domain. Accessing by ip sidesteps that step and you get a default certificate.
Isthereaway to get around the warning with an older browser?
(like IE 7, for example) You technically could, but it would compromise your security, no reason to make the tradeoff, and does nothing to address the issue with the sites on the network.]
What if OpenSSL passes but Chrome still logs the error?
Variations in hostname processing, trust store contents or network path between OpenSSL and Chrome may be the culprit. Try again with the same network path Chrome uses, and verify the SAN coverage of the cert.
How do I prevent this from occurring again by myself ?
Enable auto-renewal of certificates, track expiration dates, maintain your TLS setup at only 1.2/1.3, and ensure that all CDN or edge nodes used to deliver your domain maintain a matching, active certificate.
Is it true that VPNs are more likely to cause this than simply not having a VPN?
From my testing, yes, in about 90% of the “error on every site” instances a VPN was to blame. (Mostly cheap/free VPN services that can‘t get the relaying certificates distributed correctly.)
Is this the same as “Not Secure”message in address bar?
No, they are different. “Not Secure” simply means the site does not use HTTPS. This error indicates that the site attempted to use HTTPS and failed.
Final Thoughts
Easier to use time, this site can‘t provide a secure connection seems to be caused by something on your side a bad time clock, cached certificate, overly aggressive VPN. Try everything on the visitor side before getting completely paranoid.
If you’re looking after your site yourself, you should take this as a reminder to do a thorough job with setting up your certificate rather than applying a band-aid. Ten seconds with SSL Labs normally provides a clear picture of what has failed, and Chrome‘s own troubleshooting tips on<a href=“https://support.google.com/chrome/answer/6098869”> privacy & security errors</a> is worth saving if you have several domains to manage.
A more technical analysis of the above cipher mismatches is available here for those interested. Cloudflare‘s troubleshooting website, which is more comprehensive (if you‘re hosting sites behind their CDN) is: a href=“https://developers.cloudflare.com/ssl/troubleshooting/version-cipher-mismatch/”.
Either way a-minute check, a cert check, and don‘t click through the warning just to save five minutes.
I’m a technology writer with a passion for AI and digital marketing. I create engaging and useful content that bridges the gap between complex technology concepts and digital technologies. My writing makes the process easy and curious. and encourage participation I continue to research innovation and technology. Let’s connect and talk technology!
