Browser errors
SSL_ERROR_UNSUPPORTED_VERSION in Firefox: TLS version too old
SSL_ERROR_UNSUPPORTED_VERSIONSSL_ERROR_UNSUPPORTED_VERSION means Firefox and the website have no TLS version in common, usually because the site only supports TLS 1.0 or 1.1. Firefox requires TLS 1.2 or newer by default. Occasionally the cause is a modified Firefox setting rather than the server.
Is it the site or your device?
Usually the site supports only TLS 1.0 or 1.1; a changed Firefox setting is the less common cause. Check the server's protocol support with the SSL checker:
curl ssl.sh/example.com
- The checker shows no TLS 1.2 or 1.3: the server is outdated. Contact the owner; do not lower Firefox's security for public sites.
- The checker shows TLS 1.2/1.3 working: look at Firefox. Open
about:configand search forsecurity.tls.version. Ifminis higher than 3 ormaxis lower than 4, reset them (click the reset arrow). Also try a new profile or Troubleshoot Mode to rule out extensions and policies.
Causes
1. Server limited to TLS 1.0 or TLS 1.1
Old appliances, legacy Windows servers and unmaintained hosting often stop at TLS 1.0 or 1.1. Verify:
openssl s_client -connect example.com:443 -servername example.com -tls1_2 </dev/null 2>&1 | grep -E "Protocol|alert"
An alert such as protocol version confirms the server does not speak TLS 1.2.
2. Firefox preferences changed
security.tls.version.min set to 4 forces TLS 1.3 only, which breaks TLS 1.2 servers. security.tls.version.max set to 1 or 2 breaks almost everything. Reset both to defaults.
3. Middlebox that only speaks old TLS
A legacy proxy or firewall that intercepts HTTPS may itself negotiate TLS 1.0 with Firefox. If the error appears on many sites only on one network, ask the administrator to update it.
4. Enterprise policy
Managed Firefox installations can set the TLS range in policies.json (SSLVersionMin/SSLVersionMax). Check about:policies.
What it looks like in each browser
| Browser | What you see |
|---|---|
| Firefox | "Secure Connection Failed", a note that the site might not support TLS 1.2, and SSL_ERROR_UNSUPPORTED_VERSION |
| Chrome / Edge | ERR_SSL_VERSION_OR_CIPHER_MISMATCH |
| Safari | Safari can't establish a secure connection |
| curl | tlsv1 alert protocol version |
How site owners fix it
Enabling TLS 1.2 and 1.3 on every TLS endpoint fixes it.
1. Enable TLS 1.2 and 1.3.
ssl_protocols TLSv1.2 TLSv1.3;
SSLProtocol -all +TLSv1.2 +TLSv1.3
2. Upgrade the TLS library if the server cannot offer TLS 1.2 at all (OpenSSL 1.0.1 or later is the bare minimum; use a supported release).
3. Check every TLS endpoint: CDN, load balancer and origin may each have their own protocol settings.
4. Generate and verify. The TLS config generator gives a ready-made block; then confirm with curl ssl.sh/example.com that TLS 1.2 and 1.3 are offered.
FAQ
Firefox offers a button to enable TLS 1.0 and 1.1. Should I click it?
That button lowers the minimum version for every site, not only this one. Use it only briefly for a device you own on a trusted network, then set security.tls.version.min back to 3. For websites, ask the owner to enable TLS 1.2.
What are the default values for the TLS version preferences?
In current Firefox releases the minimum is 3 (TLS 1.2) and the maximum is 4 (TLS 1.3). If yours differ and you did not change them, an extension, enterprise policy or old tweak guide did.
Does this error affect only Firefox?
No. Chrome, Edge and Safari also refuse TLS 1.0/1.1-only servers, with different messages such as ERR_SSL_VERSION_OR_CIPHER_MISMATCH.
Only one site fails, and it is my router. What should I do?
Many older routers, NAS boxes and printers only support TLS 1.0. Check the vendor for a firmware update first. If none exists, use the device's plain HTTP management page from your own trusted network, or temporarily enable TLS 1.0 in Firefox for that session and reset security.tls.version.min to 3 immediately afterwards. Never leave the lower minimum in place for everyday browsing.