# "Safari can't establish a secure connection": causes and fixes

> Safari can't establish a secure connection when the TLS handshake fails: old TLS on the server, content filters, VPN or DNS profiles, or Screen Time limits.

Source: https://ssl.sh/errors/safari-cant-establish-secure-connection/
Last updated: 2026-11-10

**"Safari can't establish a secure connection to the server" means the encrypted handshake with the site failed, so Safari never got as far as checking a certificate.** The cause can be an outdated server, but on iPhones and Macs a filter, VPN or Screen Time setting on the device causes it as often.

## Is it the site or your device?

It can be either: an outdated server, or a filter, VPN or Screen Time setting on the device. Test the server with the [SSL checker](https://ssl.sh/tools/ssl-checker/):

```bash
curl ssl.sh/example.com
```

- **The checker cannot complete a handshake, or shows only TLS 1.0/1.1:** the server is at fault.
- **The checker succeeds:** try on mobile data, in a Private window, and with any VPN switched off. If one of those works, the cause is local, as described below.

## Causes

### 1. Server supports only old TLS versions or ciphers

Apple's platforms no longer negotiate TLS 1.0 or 1.1 in Safari, and they expect forward-secret cipher suites. Check:

```bash
openssl s_client -connect example.com:443 -servername example.com -tls1_2 </dev/null 2>&1 | grep -E "Protocol|Cipher|alert"
```

### 2. Screen Time content restrictions

"Limit Adult Websites" or an allow-list in Screen Time can make Safari fail HTTPS connections with this exact message. Review Settings > Screen Time > Content & Privacy Restrictions > App Store, Media, Web & Games > Web Content (path varies slightly between iOS versions).

### 3. VPN, DNS or filtering profiles

VPN apps, DNS-over-HTTPS profiles, ad blockers and parental controls can drop or rewrite TLS traffic. Check Settings > General > VPN & Device Management, and disconnect the VPN to test.

### 4. Security software on the Mac

Antivirus web protection or network filters that inspect HTTPS may break handshakes for some sites. Temporarily pause the HTTPS scanning feature to test. See [antivirus HTTPS scanning](https://ssl.sh/errors/antivirus-https-scanning-ssl-error/).

### 5. Broken TLS listener or wrong port

The server answers plain HTTP on port 443, or a CDN has no certificate for the hostname. Chrome would show [ERR_SSL_PROTOCOL_ERROR](https://ssl.sh/errors/err-ssl-protocol-error/) or [ERR_SSL_VERSION_OR_CIPHER_MISMATCH](https://ssl.sh/errors/err-ssl-version-or-cipher-mismatch/) for the same server.

## What it looks like on each device

| Device | What you see |
|---|---|
| iPhone / iPad Safari | "Safari Can't Open the Page" with "...because Safari can't establish a secure connection to the server" |
| Mac Safari | Same message in the page |
| iOS apps | `NSURLErrorDomain Code=-1200` ([details](https://ssl.sh/errors/nsurlerrordomain-1200/)) |
| Chrome / Edge | "This site can't provide a secure connection" |

## How site owners fix it

TLS 1.2 and 1.3 with forward-secret ciphers, and a certificate for every hostname, fix the server side.

**1. Enable TLS 1.2 and 1.3 with forward-secret ciphers.**

```nginx
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
```

The [TLS config generator](https://ssl.sh/tools/tls-config-generator/) creates equivalent settings for other servers.

**2. Make sure every hostname has a certificate** on the CDN or load balancer.

**3. Test from Apple devices.** After `curl ssl.sh/example.com` passes, open the site in Safari on an iPhone using mobile data, and check the server log for handshake errors from Apple user agents.