Phones and operating systems
"Safari can't establish a secure connection": causes and fixes
Safari can't open the page because Safari can't establish a secure connection to the server"Safari can't establish a secure connection to the server" means the encrypted handshake with the site failed, so Safari never got as far as checking a certificate. The cause can be an outdated server, but on iPhones and Macs a filter, VPN or Screen Time setting on the device causes it as often.
Is it the site or your device?
It can be either: an outdated server, or a filter, VPN or Screen Time setting on the device. Test the server with the SSL checker:
curl ssl.sh/example.com
- The checker cannot complete a handshake, or shows only TLS 1.0/1.1: the server is at fault.
- The checker succeeds: try on mobile data, in a Private window, and with any VPN switched off. If one of those works, the cause is local, as described below.
Causes
1. Server supports only old TLS versions or ciphers
Apple's platforms no longer negotiate TLS 1.0 or 1.1 in Safari, and they expect forward-secret cipher suites. Check:
openssl s_client -connect example.com:443 -servername example.com -tls1_2 </dev/null 2>&1 | grep -E "Protocol|Cipher|alert"
2. Screen Time content restrictions
"Limit Adult Websites" or an allow-list in Screen Time can make Safari fail HTTPS connections with this exact message. Review Settings > Screen Time > Content & Privacy Restrictions > App Store, Media, Web & Games > Web Content (path varies slightly between iOS versions).
3. VPN, DNS or filtering profiles
VPN apps, DNS-over-HTTPS profiles, ad blockers and parental controls can drop or rewrite TLS traffic. Check Settings > General > VPN & Device Management, and disconnect the VPN to test.
4. Security software on the Mac
Antivirus web protection or network filters that inspect HTTPS may break handshakes for some sites. Temporarily pause the HTTPS scanning feature to test. See antivirus HTTPS scanning.
5. Broken TLS listener or wrong port
The server answers plain HTTP on port 443, or a CDN has no certificate for the hostname. Chrome would show ERR_SSL_PROTOCOL_ERROR or ERR_SSL_VERSION_OR_CIPHER_MISMATCH for the same server.
What it looks like on each device
| Device | What you see |
|---|---|
| iPhone / iPad Safari | "Safari Can't Open the Page" with "...because Safari can't establish a secure connection to the server" |
| Mac Safari | Same message in the page |
| iOS apps | NSURLErrorDomain Code=-1200 (details) |
| Chrome / Edge | "This site can't provide a secure connection" |
How site owners fix it
TLS 1.2 and 1.3 with forward-secret ciphers, and a certificate for every hostname, fix the server side.
1. Enable TLS 1.2 and 1.3 with forward-secret ciphers.
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
The TLS config generator creates equivalent settings for other servers.
2. Make sure every hostname has a certificate on the CDN or load balancer.
3. Test from Apple devices. After curl ssl.sh/example.com passes, open the site in Safari on an iPhone using mobile data, and check the server log for handshake errors from Apple user agents.
FAQ
Why does the site open in Chrome on my Mac but not in Safari?
Chrome on macOS uses its own TLS stack and certificate verifier, while Safari uses Apple's. A server configuration that one accepts can fail in the other, and Safari-only settings such as content blockers or Screen Time limits do not affect Chrome.
Can Screen Time cause this?
Yes. When Content & Privacy Restrictions limit adult websites or allow only listed sites, Safari blocks HTTPS pages it cannot classify, and users often see this message instead of a clear block page. Check Settings > Screen Time > Content & Privacy Restrictions.
Is it safe to keep retrying?
Yes. Unlike a certificate warning, this error never lets you proceed over an insecure connection, so retrying carries no risk. It will not work until the cause is fixed.