ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY SSL / TLS Origin: Network OSI layer 6 · Presentation Last updated 4 Nov 2026

Chrome: ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY — HTTP/2 requires a modern TLS cipher

The server speaks HTTP/2 but negotiated a TLS version or cipher that HTTP/2 forbids (blocklisted ciphers or TLS below 1.2).

Exact message you may see HTTP/2 inadequate transport security
Explore the map of this error Full error map →
Seen on: SSL Nginx

Meaning

HTTP/2 mandates TLS 1.2+ and prohibits a list of weak cipher suites. If your Nginx/Apache/load balancer enables http2 but keeps old ciphers first, browsers abort. Use a modern cipher list (Mozilla "intermediate") and put ECDHE-GCM suites first.

Common causes

  • HTTP/2 enabled with legacy cipher order
  • TLS 1.0/1.1 still negotiated
  • Cipher string includes blocklisted suites first
  • Old OpenSSL on the server
  • Load balancer policy outdated

⚡ Quick fix

  1. Use Mozilla intermediate ciphers and TLS 1.2/1.3
  2. Update OpenSSL / web server
  3. Check with nghttp -v https://host or SSL Labs

Detailed fix by platform

Nginx

  1. listen 443 ssl http2; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;

How to diagnose

  1. Protocol — h2 negotiated?
  2. Cipher — On HTTP/2 blocklist?
  3. TLS — 1.2+?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

AH01909: server certificate does NOT include an ID which matches the server name — Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name (SSL / TLS)AH01909: server certi…CAA record forbids issuance — Let's Encrypt/CA: CAA record for example.com prevents issuance (SSL / TLS)CAA record forbids is…ERR_SSL_KEY_USAGE_INCOMPATIBLE — Chrome: ERR_SSL_KEY_USAGE_INCOMPATIBLE — the certificate's key usage doesn't allow the negotiated cipher (SSL / TLS)ERR_SSL_KEY_USAGE_INC…ERR_SSL_VERSION_OR_CIPHER_MISMATCH — Chrome: This site can’t provide a secure connection — uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Browser)ERR_SSL_VERSION_OR_CI…no "ssl_certificate" is defined for the "listen ... ssl" directive — Nginx: [emerg] no "ssl_certificate" is defined for the "listen ... ssl" directive in /etc/nginx/sites-enabled/default:3 (SSL / TLS)no "ssl_certificate" …SSLCertificateFile: file does not exist — Apache: AH02240: Server should be SSL-aware but has no certificate configured / SSLCertificateFile: file '/etc/ssl/x.crt' does not exist or is empty (SSL / TLS)SSLCertificateFile: f…sslv3 alert handshake failure — OpenSSL: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure (SSL alert number 40) (SSL / TLS)sslv3 alert handshake…the "listen ... http2" directive is deprecated — Nginx: nginx: [warn] the "listen ... http2" directive is deprecated, use the "http2" directive instead (Nginx / Apache)the "listen ... http2…ERR_HTTP2…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.