# SSL_ERROR_UNSUPPORTED_VERSION in Firefox: TLS version too old

> Firefox shows SSL_ERROR_UNSUPPORTED_VERSION when a site does not support TLS 1.2 or later. Why re-enabling TLS 1.0 is risky and how servers fix it.

Source: https://ssl.sh/errors/ssl-error-unsupported-version/
Last updated: 2026-11-10

**SSL_ERROR_UNSUPPORTED_VERSION means Firefox and the website have no TLS version in common, usually because the site only supports TLS 1.0 or 1.1.** Firefox requires TLS 1.2 or newer by default. Occasionally the cause is a modified Firefox setting rather than the server.

## Is it the site or your device?

Usually the site supports only TLS 1.0 or 1.1; a changed Firefox setting is the less common cause. Check the server's protocol support with the [SSL checker](https://ssl.sh/tools/ssl-checker/):

```bash
curl ssl.sh/example.com
```

- **The checker shows no TLS 1.2 or 1.3:** the server is outdated. Contact the owner; do not lower Firefox's security for public sites.
- **The checker shows TLS 1.2/1.3 working:** look at Firefox. Open `about:config` and search for `security.tls.version`. If `min` is higher than 3 or `max` is lower than 4, reset them (click the reset arrow). Also try a new profile or Troubleshoot Mode to rule out extensions and policies.

## Causes

### 1. Server limited to TLS 1.0 or TLS 1.1

Old appliances, legacy Windows servers and unmaintained hosting often stop at TLS 1.0 or 1.1. Verify:

```bash
openssl s_client -connect example.com:443 -servername example.com -tls1_2 </dev/null 2>&1 | grep -E "Protocol|alert"
```

An alert such as `protocol version` confirms the server does not speak TLS 1.2.

### 2. Firefox preferences changed

`security.tls.version.min` set to 4 forces TLS 1.3 only, which breaks TLS 1.2 servers. `security.tls.version.max` set to 1 or 2 breaks almost everything. Reset both to defaults.

### 3. Middlebox that only speaks old TLS

A legacy proxy or firewall that intercepts HTTPS may itself negotiate TLS 1.0 with Firefox. If the error appears on many sites only on one network, ask the administrator to update it.

### 4. Enterprise policy

Managed Firefox installations can set the TLS range in `policies.json` (`SSLVersionMin`/`SSLVersionMax`). Check `about:policies`.

## What it looks like in each browser

| Browser | What you see |
|---|---|
| Firefox | "Secure Connection Failed", a note that the site might not support TLS 1.2, and `SSL_ERROR_UNSUPPORTED_VERSION` |
| Chrome / Edge | [ERR_SSL_VERSION_OR_CIPHER_MISMATCH](https://ssl.sh/errors/err-ssl-version-or-cipher-mismatch/) |
| Safari | [Safari can't establish a secure connection](https://ssl.sh/errors/safari-cant-establish-secure-connection/) |
| curl | `tlsv1 alert protocol version` |

## How site owners fix it

Enabling TLS 1.2 and 1.3 on every TLS endpoint fixes it.

**1. Enable TLS 1.2 and 1.3.**

```nginx
ssl_protocols TLSv1.2 TLSv1.3;
```

```apache
SSLProtocol -all +TLSv1.2 +TLSv1.3
```

**2. Upgrade the TLS library** if the server cannot offer TLS 1.2 at all (OpenSSL 1.0.1 or later is the bare minimum; use a supported release).

**3. Check every TLS endpoint**: CDN, load balancer and origin may each have their own protocol settings.

**4. Generate and verify.** The [TLS config generator](https://ssl.sh/tools/tls-config-generator/) gives a ready-made block; then confirm with `curl ssl.sh/example.com` that TLS 1.2 and 1.3 are offered.