Fixed: ERR_SSL_VERSION_OR_CIPHER_MISMATCH on Windows 10/11

When This Error Hits

You're browsing a site you've used before — say, a bank or corporate portal — and suddenly Chrome or Edge throws ERR_SSL_VERSION_OR_CIPHER_MISMATCH. The page won't load. It's not a broken site, because it works on your phone. The real trigger: you recently disabled TLS 1.0 or 1.1 in Windows via Group Policy, or a third-party security tool (like a corporate VPN client) tweaked the cipher suites. What's actually happening is your browser can't find a common encryption method with the server — the server wants TLS 1.2 with a specific cipher, but your Windows Schannel stack isn't offering it.

Root Cause

Windows uses Schannel (Secure Channel) for TLS. Chrome and Edge don't bundle their own TLS — they rely on Schannel. When Schannel's list of enabled TLS versions or cipher suites gets trimmed, the browser fails. The mismatch usually comes from one of two things:

• TLS 1.2 itself is disabled at the OS level (common after registry cleanups).
• A required cipher suite is missing — like TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 or TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256. Many modern sites demand these AES-GCM suites, and if they're gone, the handshake fails.

The Fix: Enable TLS 1.2 and Restore Ciphers

Skip the browser flags and clearing cache — the real fix is in the registry. Here's what you'll do.

1. Open Registry Editor as Administrator. Press Win+R, type regedit, then right-click and choose Run as Administrator.
2. Navigate to TLS 1.2 keys. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client. If the path doesn't exist, you'll need to create the folders manually — Protocols, then TLS 1.2, then Client.
3. Set DWORD values. Inside the Client key, look for DisabledByDefault and Enabled. Set both to 0 (zero). If Enabled is missing, create it as a DWORD (32-bit). For DisabledByDefault: 0 means enabled. For Enabled: 1 means force-enable TLS 1.2. But wait — you want Enabled = 0 here. The reason: Enabled = 0 tells Schannel to use its default behavior (which respects DisabledByDefault). Setting Enabled = 1 can actually override other settings and break things. Stick with 0 for both.
4. Restore default cipher suites. Open Command Prompt as Administrator. Run this command to list your current cipher suites:
   

   Get-TlsCipherSuite | Format-Table Name

   
   If you see fewer than 30 or so, you've got missing ciphers. Run this to restore defaults:
   

   Disable-TlsCipherSuite -Name "TLS_RSA_WITH_AES_128_CBC_SHA" -ErrorAction SilentlyContinue
   Enable-TlsCipherSuite -Name "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" -ErrorAction SilentlyContinue
   Enable-TlsCipherSuite -Name "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
   Enable-TlsCipherSuite -Name "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
   Enable-TlsCipherSuite -Name "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"

   
   The reason step 3 works: these are the most common AES-GCM suites used by modern web servers. Without them, the handshake fails even if TLS 1.2 is enabled.
5. Reboot. Schannel caches settings at boot. A restart is non-negotiable here — a simple browser restart won't reload the Schannel config.

If It Still Fails

Three things to check:

• Group Policy override. If you're on a corporate machine, run gpresult /h gp.html and open the file. Look under Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. If "System cryptography: Use FIPS-compliant algorithms" is enabled, that kills non-FIPS ciphers. You can't fix that yourself — talk to IT.
• Third-party antivirus. Some AV suites (looking at you, McAfee and Avast) inject their own TLS inspection. Temporarily disable the HTTPS scanning feature to test.
• Server is stuck on TLS 1.0/1.1. This is rare in 2024, but some legacy sites never upgraded. You can test by enabling TLS 1.0 temporarily in the same registry path (under Protocols, create TLS 1.0 > Client, set DWORDs same as above). If it works, the server is the problem — the site needs updating.

One last thing: if you're running an old Windows build (pre-1903), you might need to install KB update KB4054519 for full TLS 1.2 support. Check your build with winver.