# PR_END_OF_FILE_ERROR in Firefox: handshake cut off, fixes

> PR_END_OF_FILE_ERROR means the connection was cut during the TLS handshake. Usually a proxy, security software, changed TLS settings or the server.

Source: https://ssl.sh/errors/pr-end-of-file-error/
Last updated: 2026-11-10

**PR_END_OF_FILE_ERROR means the connection was closed in the middle of the TLS handshake.** Firefox was waiting for the server's reply and got nothing. Something on the path, often a proxy or security software on your own computer, or the server itself, hung up.

## Is it the site or your device?

Often it is local: a proxy, VPN or security software on your computer cuts the handshake. Test the site from outside with the [SSL checker](https://ssl.sh/tools/ssl-checker/):

```bash
curl ssl.sh/example.com
```

- **The checker also fails the handshake:** the server or its firewall drops the connection. Contact the site owner.
- **The checker works, and other sites also fail in Firefox:** the cause is local. Work through Firefox's proxy settings, security software and preferences below.
- **The checker works and only this site fails for you:** your network may be blocking or interfering with that destination; try another network.

## Causes

### 1. Proxy settings in Firefox

Firefox can use its own proxy configuration. A manual proxy that no longer exists, or a PAC file that fails, cuts connections. Open Settings > General > Network Settings and choose "Use system proxy settings" or "No proxy" to test.

### 2. Security software or VPN client

Antivirus HTTPS scanning, parental-control filters and VPN clients sit in the middle of TLS. A bug or a disconnected service makes them close the connection. Pause the HTTPS-scanning feature or disconnect the VPN to test, then update the software. See [antivirus HTTPS scanning](https://ssl.sh/errors/antivirus-https-scanning-ssl-error/).

### 3. Modified TLS preferences

Changed `security.tls.version.*` or disabled `security.ssl3.*` cipher preferences can leave Firefox offering something the server immediately rejects by closing the socket. In `about:config`, reset any bold (modified) entries under those names.

### 4. Server or firewall closes the handshake

Some servers and load balancers close the TCP connection instead of sending a proper TLS alert when they cannot agree on a protocol or cipher, or when a firewall rule blocks the client. Check from the server side:

```bash
openssl s_client -connect example.com:443 -servername example.com -brief </dev/null
```

An `unexpected eof` or `connection reset` points to the server or its network.

### 5. Corrupted profile

Rarely, a damaged profile causes TLS failures. Test with a new profile from `about:profiles`.

## What it looks like in each browser

| Browser | What you see |
|---|---|
| Firefox | "Secure Connection Failed", "An error occurred during a connection to example.com. PR_END_OF_FILE_ERROR" |
| Chrome / Edge | [ERR_SSL_PROTOCOL_ERROR](https://ssl.sh/errors/err-ssl-protocol-error/) or `ERR_CONNECTION_CLOSED` |
| Safari | [Safari can't establish a secure connection](https://ssl.sh/errors/safari-cant-establish-secure-connection/) |
| curl | `unexpected eof while reading` or `Connection reset by peer` |

## How site owners fix it

A server that completes handshakes with TLS 1.2 and 1.3, behind firewalls that do not reset clients, fixes the server side.

**1. Make sure the server completes handshakes.** Enable TLS 1.2 and 1.3 with modern ciphers; the [TLS config generator](https://ssl.sh/tools/tls-config-generator/) provides a tested block.

**2. Review firewalls, WAFs and rate limits** that may reset connections from certain clients or regions. Check their logs at the time of the failure.

**3. Watch for resource limits.** Worker or connection limits on the TLS terminator can drop new handshakes under load.

**4. Verify externally** with `curl ssl.sh/example.com` and from several networks. If only one client network fails, collect its IP range and compare with your firewall rules.