# Chrome: ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY — HTTP/2 requires a modern TLS cipher

**Code:** `ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY` · **Category:** SSL / TLS · **Seen on:** SSL, Nginx

The server speaks HTTP/2 but negotiated a TLS version or cipher that HTTP/2 forbids (blocklisted ciphers or TLS below 1.2).

## Meaning

HTTP/2 mandates TLS 1.2+ and prohibits a list of weak cipher suites. If your Nginx/Apache/load balancer enables `http2` but keeps old ciphers first, browsers abort. Use a modern cipher list (Mozilla "intermediate") and put ECDHE-GCM suites first.

## Common causes

- HTTP/2 enabled with legacy cipher order
- TLS 1.0/1.1 still negotiated
- Cipher string includes blocklisted suites first
- Old OpenSSL on the server
- Load balancer policy outdated

## Quick fix

1. Use Mozilla intermediate ciphers and TLS 1.2/1.3
2. Update OpenSSL / web server
3. Check with `nghttp -v https://host` or SSL Labs

## Detailed fix by platform

### Nginx

1. `listen 443 ssl http2; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;`

## How to diagnose

1. **Protocol** — h2 negotiated?
2. **Cipher** — On HTTP/2 blocklist?
3. **TLS** — 1.2+?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/ssl/err-http2-inadequate-transport-security)