Browser errors
PR_END_OF_FILE_ERROR in Firefox: handshake cut off, fixes
PR_END_OF_FILE_ERRORPR_END_OF_FILE_ERROR means the connection was closed in the middle of the TLS handshake. Firefox was waiting for the server's reply and got nothing. Something on the path, often a proxy or security software on your own computer, or the server itself, hung up.
Is it the site or your device?
Often it is local: a proxy, VPN or security software on your computer cuts the handshake. Test the site from outside with the SSL checker:
curl ssl.sh/example.com
- The checker also fails the handshake: the server or its firewall drops the connection. Contact the site owner.
- The checker works, and other sites also fail in Firefox: the cause is local. Work through Firefox's proxy settings, security software and preferences below.
- The checker works and only this site fails for you: your network may be blocking or interfering with that destination; try another network.
Causes
1. Proxy settings in Firefox
Firefox can use its own proxy configuration. A manual proxy that no longer exists, or a PAC file that fails, cuts connections. Open Settings > General > Network Settings and choose "Use system proxy settings" or "No proxy" to test.
2. Security software or VPN client
Antivirus HTTPS scanning, parental-control filters and VPN clients sit in the middle of TLS. A bug or a disconnected service makes them close the connection. Pause the HTTPS-scanning feature or disconnect the VPN to test, then update the software. See antivirus HTTPS scanning.
3. Modified TLS preferences
Changed security.tls.version.* or disabled security.ssl3.* cipher preferences can leave Firefox offering something the server immediately rejects by closing the socket. In about:config, reset any bold (modified) entries under those names.
4. Server or firewall closes the handshake
Some servers and load balancers close the TCP connection instead of sending a proper TLS alert when they cannot agree on a protocol or cipher, or when a firewall rule blocks the client. Check from the server side:
openssl s_client -connect example.com:443 -servername example.com -brief </dev/null
An unexpected eof or connection reset points to the server or its network.
5. Corrupted profile
Rarely, a damaged profile causes TLS failures. Test with a new profile from about:profiles.
What it looks like in each browser
| Browser | What you see |
|---|---|
| Firefox | "Secure Connection Failed", "An error occurred during a connection to example.com. PR_END_OF_FILE_ERROR" |
| Chrome / Edge | ERR_SSL_PROTOCOL_ERROR or ERR_CONNECTION_CLOSED |
| Safari | Safari can't establish a secure connection |
| curl | unexpected eof while reading or Connection reset by peer |
How site owners fix it
A server that completes handshakes with TLS 1.2 and 1.3, behind firewalls that do not reset clients, fixes the server side.
1. Make sure the server completes handshakes. Enable TLS 1.2 and 1.3 with modern ciphers; the TLS config generator provides a tested block.
2. Review firewalls, WAFs and rate limits that may reset connections from certain clients or regions. Check their logs at the time of the failure.
3. Watch for resource limits. Worker or connection limits on the TLS terminator can drop new handshakes under load.
4. Verify externally with curl ssl.sh/example.com and from several networks. If only one client network fails, collect its IP range and compare with your firewall rules.
FAQ
Other browsers work, only Firefox shows PR_END_OF_FILE_ERROR. Why?
Firefox has its own proxy settings and its own TLS preferences, separate from the system. A stale manual proxy, a removed proxy extension, or tweaked security.ssl3.* entries affect only Firefox. Check Settings > Network Settings and reset modified preferences.
Will creating a new Firefox profile help?
It is a good diagnostic. If a fresh profile works, the problem is a setting, extension or corrupted file in your old profile. You can then use Refresh Firefox to keep bookmarks and passwords while resetting the rest.
Can my VPN cause this?
Yes. VPN or network-filtering clients that hook into connections can drop TLS handshakes when they are misconfigured or disconnected. Disconnect it briefly to test, then update or reconfigure it.