This generic error frequently means the server isn't actually speaking TLS on the port the browser is connecting to — commonly, a misconfiguration where plain HTTP is being served on port 443 instead of a proper HTTPS listener.
The fix
Check your web server's configuration to confirm an SSL/TLS listener block actually exists and is correctly bound to port 443, and that the certificate files it references exist and are readable. A corrupted certificate file can also trigger this error — verify the file parses correctly with openssl x509 -in yourcert.pem -text -noout.
Why this generic-sounding error requires additional diagnosis to pin down
Unlike more specific errors elsewhere in this category, this generic protocol error can stem from several distinct underlying causes — a genuinely broken TLS configuration, a non-TLS service running on the expected HTTPS port, or network-level interference — requiring the broader diagnostic approach covered in our OpenSSL troubleshooting playbook to actually identify the specific cause.
How to rule out a non-HTTPS service accidentally running on port 443
Connecting directly with OpenSSL's s_client to the specific port quickly reveals whether a TLS handshake is even being attempted at all — if the connection behaves like a plain, non-TLS service, the actual issue may be a misconfigured server serving HTTP on the HTTPS port rather than any genuine certificate or protocol problem.
What to try first when encountering this error on a site you manage yourself
Running the OpenSSL diagnostic playbook covered elsewhere on this site against your own domain is the fastest way to get specific, actionable detail beyond this generic browser message, which by itself doesn't indicate exactly what protocol-level issue is actually occurring.
How a recently changed server configuration commonly causes this error to appear suddenly
A recent server software update, a certificate renewal that inadvertently changed configuration, or a manual configuration change are all common triggers for this error appearing suddenly on a site that previously worked fine — checking recent change history is a reasonable first troubleshooting step.
A final note on checking recent infrastructure changes
If this error appears specifically after a recent hosting change or migration, checking whether your DNS is correctly pointing at your new infrastructure, rather than a partially-migrated or misconfigured intermediate state, is a common and often overlooked culprit worth ruling out early in your troubleshooting.
What a corrupted certificate file specifically looks like when inspected directly
A corrupted certificate file typically fails to parse at all when checked directly with OpenSSL, producing a clear parsing error rather than valid-looking output — this immediately distinguishes a corrupted file from a more subtle configuration issue, and confirms the fix is simply re-obtaining a clean copy of the certificate.
How network-level interference can produce this exact error independent of any server misconfiguration
Certain restrictive network environments (some corporate networks, some countries' network infrastructure) can interfere with TLS handshakes at the network level, producing a protocol error that has nothing to do with the actual server's configuration — testing the same URL from a different network helps rule this out as a contributing factor.
A quick closing checklist
A quick closing checklist covers testing directly with OpenSSL for more specific diagnostic detail, checking for a non-TLS service accidentally running on the HTTPS port, and reviewing any recent infrastructure changes that might correlate with when the error first appeared.
Why keeping a change log of server configuration updates helps with this specific error category
Because this error can stem from several different underlying causes, having a clear record of recent configuration changes lets you quickly correlate the error's appearance with a specific recent change, considerably narrowing your investigation.