To make things simple, both parties will say \u2018hello\u2019 first. Then, the server will provide a certificate, which the client will verify. Once the certificate has been proven to be authentic, the session will begin. Before that, a key will be created, which will allow the data exchange between the servers.<\/p>\n
How to Fix TLS Handshake Issues<\/h2>\n
Unfortunately, if the problem stems from the server, there is nothing you can do. For instance, if the certificate from the server cannot be authenticated, then the matter is out of your hands.\u00a0 Also, some TLS signatures and versions are now obsolete and removed for safety reasons. Modern browsers will block connections to websites using those protocols, which can produce the error. It is best to stay away from such websites if you can\u2019t personally vouch for their safety. However, if you are having issues with the browser you\u2019re using, then there are still plenty of workarounds you can try. Also, if you\u2019re dealing with a mismatch in the TLS protocol, you can fix the problem from the browser. Various reasons could be behind a TLS handshake error . Before you try to fix the problem, you should ensure that you\u2019re definitely dealing with a TLS handshake error. In most cases, you can follow these rules:<\/p>\n
- \n
- Try visiting other sites and see if the problem persists.<\/li>\n
- If you\u2019re using a WiFi network, try switching to a wired one.<\/li>\n
- Try other network connections. For instance, use a different router or switch to a public network.<\/li>\n
- Try using another web browser<\/a>.<\/li>\n<\/ol>\n
Once you\u2019ve established the cause of the problem, you might ask, \u201cShould I disable a TLS handshake on my browser?\u201d\u00a0 We understand your frustration, but we do not recommend doing it. After all, the TLS protocol is one of the best ways to ensure a secure browsing experience.\u00a0 Indeed, you can continue browsing a website even with an invalid certificate. However, you should never perform any form of transaction with it. For example, do not submit password credentials or use your credit card. On the other hand, there are times when the TLS handshake problem stems from issues with your browser. In this case, you can fix the problem by reconfiguring some settings on your browser.\u00a0 We\u2019ll share some of the best workarounds below.<\/p>\n
Solution 1: Ensuring the Correct System Time<\/h3>\n
Most of the time, a TLS handshake fails because of incorrect system time settings. Keep in mind that the system time is a vital factor in testing whether a certificate is still valid or expired.<\/p>\n
So, if the time on your PC does not match the server\u2019s, then it will seem like the certificates are no longer valid. So, we recommend that you set the system time to \u2018automatic\u2019. Here are the steps:<\/p>\n
- \n
- On your keyboard, press
Windows Key+I<\/code>. Doing so will open the Settings app<\/em>.<\/li>\n- Once you\u2019re on the Settings app<\/em>, select Time & Language<\/em>.<\/li>\n
- Go to the right pane, then toggle the switch under Set Time Automatically<\/em> to On<\/em>.<\/li>\n
- Restart your computer, then try visiting the site again to see if the TLS handshake error is gone.<\/li>\n<\/ol>\n
Follow these steps for Windows 11:<\/strong><\/p>\n
- \n
- Launch the Settings app<\/em> using the
Win+I<\/code> combo.<\/li>\n- Click on Time & Language<\/em> in the left pane.<\/li>\n
- Select Date & Time<\/em> on the Time & Language<\/em> page.<\/li>\n<\/ol>\n
\r\n\r\n![\"Windows]()
\r\n <\/div>\r\n <\/div>\r\n<\/div>\n- \n
- Toggle on the \u201cSet the time automatically<\/em>\u201d option.<\/li>\n<\/ul>\n\r\n\r\n
![\"Windows]()
\r\n <\/div>\r\n <\/div>\r\n<\/div>\nSolution 2: Changing the TLS Protocol in Windows 10<\/h3>\n
Perhaps, the issue has something to do with the TLS version that your browser is using. It is worth noting that Windows 10 and earlier versions of the operating system has a central internet protocol setting with options to choose TLS versions.<\/p>\n
You should also note that this option worked directly with the new retired Internet Explorer and older version of Microsoft Edge. The new Edge and other browsers such as Chrome have their native protocol policies and use the latest versions of TLS.
\nYou can access Internet Properties to switch to a different TLS version. To do that, follow these instructions:<\/p>\n- \n
- Launch the Run dialog box<\/em> by pressing
Windows Key+R<\/code> on your keyboard.<\/li>\n- Inside the Run dialog box<\/em>, type
inetcpl.cpl<\/code>, then click OK<\/em>.<\/li>\n<\/ul>\n\r\n\r\n![\"Inetcpl.cpl]()
\r\n <\/div>\r\n <\/div>\r\n<\/div>\n- \n
- On the Internet Properties<\/em> window, go to the Advanced<\/em> tab.<\/li>\n
- Scroll down until you get to the Security<\/em> section, where you can add or remove TLS protocols.<\/li>\n
- If the website you\u2019re trying to access needs TLS 1.2. then you need to select it. You can also select multiple TLS versions.<\/li>\n<\/ul>\n
\r\n\r\n![\"If]()
\r\n <\/div>\r\n <\/div>\r\n<\/div>\n- \n
- Click Apply<\/em> and OK<\/em> to save the changes you\u2019ve made.<\/li>\n
- After changing the TLS version, try accessing the same website again.<\/li>\n<\/ul>\n
Another important thing to remember is that major browsers such as Google Chrome and Firefox have long deprecated TLS 1.0 and TLS 1.1<\/a>. You’ll likely get a safety error or a TLS handshake protocol error message if the website uses any of these protocols . So, if you want to change the TLS version on Firefox, use the following steps:<\/p>\n
- \n
- Launch Firefox<\/em>, then type
about:config<\/code>\u00a0in the address bar.<\/li>\n- Press
Enter<\/code> and click \u201cAccept the risk and continue.<\/em>\u201d<\/li>\n<\/ul>\n\r\n\r\n![\"Click]()
Accept the risk and continue<\/em> \" class=\"lazyload screenshots__image\">\r\n <\/div>\r\n <\/div>\r\n<\/div>\n- \n
- Next, click the search box and type
TLS<\/code>.<\/li>\n- Now, look for security.tls.version.min<\/em> and security.tls.version.max<\/em>.<\/li>\n
- You can force different TLS versions by using the following:<\/li>\n<\/ul>\n
\r\n\tNote<\/div>\r\n\tFirefox also deprecated obsolete TLS versions (1.o and 1.1)<\/a>. So, you should ideally force TLS 1.2 and 1.3 if they are not already enabled for some reason.<\/div>\r\n<\/div>\nForce TLS 1 and 1.1 by entering 1 and 2. <\/em><\/p>\n
Force TLS 1.2 by entering 3. <\/em><\/p>\n
Force a maximum protocol of TLS ( security.tls.version.max) 1.3 by entering 4. <\/em><\/p>\n
If you absolutely have to visit the website with the deprecated TLS version, you can enable the versions by going to the \u201csecurity.tls.version.enable-deprecated\u201d option and clicking on the switch button on its right to change its value to True.<\/p>\n
Make sure you switch back to false once you finish visiting the website.<\/p>\n
Unfortunately, Chrome and Edge have sterner policies when it comes to TLS handshakes, as you cannot change the TLS version. That said, you can allow Chrome to accept handshakes from SHA-1 TLS websites, another deprecated encryption.<\/p>\n
Follow these steps:<\/p>\n
- \n
- Launch Chrome<\/em>, enter
chrome:\/\/flags\/<\/code>\u00a0into the address bar and punch theEnter<\/code> key.<\/li>\n- Once the Experiments page<\/em> (alongside its warning) displays, go to the search box and type
tls<\/code>.<\/li>\n- After the results appear, navigate to \u201cAllow SHA-1 server signatures in TLS<\/em>\u201d and choose Enabled<\/em> from its drop-down dialog.<\/li>\n<\/ul>\n
\r\n\r\n![\"Enter]()
\r\n <\/div>\r\n <\/div>\r\n<\/div>\n\r\n\tThis might be a risky move as most browsers have removed SHA-1 TLS server signatures <\/a> because they have become increasingly unsafe. So, make sure you personally trust websites you visit before turning on this feature.<\/p>\nWe also recommend switching it off once you\u2019re done.<\/div>\r\n<\/div>\n
Solution 3: Disabling Interfering Program<\/h3>\n
If you use a third-party antivirus and firewall application, it might be blocking your connection to the website. Some of these applications have strict policies to block specific websites. So turn off your third-party antivirus\/firewall for a while and use the native Windows Security. If the issue goes away after disabling the antivirus, you can switch to another system protection program that will provide the same level of protection (or even better) without compromising your browsing experience.<\/p>\n
\r\n\tPRO TIP<\/div>\r\nAuslogics Anti-Malware<\/a> is a good pick. It works with a low-profile and does not cause conflicts with your main antivirus suite. That said, it packs powerful features that helps you keep your system safe from even the most sophisticated software attacks. <\/div>\r\n\r\n Download for Free<\/a>\r\n Learn More<\/a>\r\n <\/div>\r\n<\/div>\r\n\nAnother software application or browser extension that may be blocking the TLS handshake is your VPN (Virtual Private Network)<\/a>. These applications are used to reroute network traffic to conceal IP address, improve security, and bypass restrictions.<\/p>\n
In some cases, the VPN server may not agree with the website\u2019s server, causing the error to occur. It could be that the website is blocking traffic from the VPN server or the VPN is blocking the website\u2019s protocol.<\/p>\n
You can switch VPNs or use another device (without a VPN connection) to access the website to confirm the cause of the problem.<\/p>\n
\nAlso Read: <\/strong>How to Choose VPN: Best Free VPN for Windows 10 PC<\/a><\/p>\n
\nSolution 4: Deleting the Certificate Database or Browser Profile<\/h3>\n
Browsers keep a certificate database. For instance, Firefox profiles maintain a cert8.db file. There is one way to know that the TLS handshake failure is related to the local certificate database. You can try deleting the cert8.db file on Firefox. If the error disappears when you restart your computer and browser, then you\u2019ve determined the culprit.<\/p>\n
For Edge, the Certificate Manager is responsible for handling the certificates. You can delete the certificates by following these steps:<\/p>\n
- \n
- Open Edge<\/em>, then enter
edge:\/\/settings\/privacy<\/code>\u00a0in the address bar.<\/li>\n- Type
Manage HTTPS<\/code>\u00a0in the settings search bar.<\/li>\n<\/ul>\n\r\n\r\n![\"Type]()
\r\n <\/div>\r\n <\/div>\r\n<\/div>\n- \n
- Click the \u2018Manage HTTPS\/SSL certificates and settings<\/em>\u2019 option.<\/li>\n
- Now, delete certificates that are expired.<\/li>\n
- To delete expired certificates, switch between tabs and check each certificate’s expiry date date under the appropriate column.<\/li>\n
- Once you see an expired certificate, click on it once and select Remove<\/em>. Confirm your option in the dialog that pops up.<\/li>\n<\/ul>\n
\r\n\r\n![\"Click]()
\r\n <\/div>\r\n <\/div>\r\n<\/div>\nIf you\u2019re having trouble finding the certificate database, your best bet is to delete the browser profile. Once you\u2019ve done this, you can try accessing the website again to see if the TLS error is gone.<\/p>\n
Deleting a browsing profile permanently removes the user’s browsing data, including passwords, history, and favorites. Each web browser has a different method of deleting profiles.<\/p>\n
Follow this step for Microsoft Edge:<\/strong><\/p>\n
- \n
- Launch Microsoft Edge<\/em> and click on the three dots in the top right corner.<\/li>\n
- Click on Settings<\/em> after the menu appears.<\/li>\n<\/ul>\n
\r\n\r\n![\"Click]()
\r\n <\/div>\r\n <\/div>\r\n<\/div>\n- \n
- Select Profiles<\/em> on the left hand side.<\/li>\n
- Go to the Profile<\/em> on the right and click the three dots.<\/li>\n
- Select Remove<\/em> from the menu.<\/li>\n<\/ul>\n
\r\n\r\n![\"Select]()
\r\n <\/div>\r\n <\/div>\r\n<\/div>\n- \n
- Click on Remove<\/em> after the warning pops up.<\/li>\n<\/ul>\n
Follow these steps to remove a Google Chrome Profile:<\/strong><\/p>\n
- \n
- Launch Google Chrome<\/em> and click on the Profile<\/em> icon in the top-right corner. It’s next to the three dots.<\/li>\n
- Once the Profile<\/em> menu appears, go to Other Profiles<\/em> towards the bottom and click on the gear icon (Manage Profiles<\/em>).<\/li>\n
- When you see the “Who’s using Chrome<\/em>” or \u201cWelcome to Chrome Profiles<\/em>\u201d window, click on the three dots in the box to the profile you want to delete and select Delete<\/em>.<\/li>\n
- Click on Delete<\/em> to confirm your decision.<\/li>\n<\/ul>\n
Follow these steps to remove a profile from Firefox:<\/strong><\/p>\n
- \n
- Launch Mozilla Firefox<\/em>, enter
about:profiles<\/code>\u00a0into the address box, and hitEnter<\/code>.<\/li>\n- Click on Remove<\/em> under the profile you want to get rid of.<\/li>\n<\/ul>\n
\r\n\r\n![\"Click]()
\r\n <\/div>\r\n <\/div>\r\n<\/div>\n- \n
- For the purposes of this fix, you’ll be deleting the files related to the profile. So, select Delete Files<\/em>.<\/li>\n<\/ul>\n\r\n\r\n
![\"Select]()
\r\n <\/div>\r\n <\/div>\r\n<\/div>\nSolution 5: Resetting Your Browser<\/h3>\n
If none of the fixes we shared is able to resolve the TLS problem, then your last resort is to reset your browser. The best way to do this is to uninstall and reinstall your browser.<\/p>\n
That said, it will make sense to reset your browser to default settings before uninstalling it. Some extensions and apps you added might have changed important settings that may be causing the TLS handshake error.<\/p>\n
Follow these steps to reset Chrome<\/a>:<\/strong><\/p>\n
- \n
- Launch Chrome<\/em> and click on the three dots in the top-right corner.<\/li>\n
- Click Settings<\/em> after the menu appears.<\/li>\n
- Go to the bottom of the left pane and click Reset Settings<\/em>.<\/li>\n
- Select “Restore settings to their original defaults<\/em>” and click the Reset Settings<\/em> button in the warning dialog that pops up.<\/li>\n<\/ul>\n
Follow these steps to reset Mozilla Firefox:<\/strong><\/p>\n
- \n
- Launch Firefox<\/em> and click on the three lines in the top-right corner.<\/li>\n
- After the menu appears, select Help<\/em>.<\/li>\n<\/ul>\n
\r\n\r\n![\"Select]()
\r\n <\/div>\r\n <\/div>\r\n<\/div>\n- \n
- Click More Troubleshooting Information<\/em>.<\/li>\n
- Click Refresh Firefox<\/em> under “Give Firefox a tune up<\/em>” once the Troubleshooting Information<\/em> screen appears.<\/li>\n
- Click on the Refresh Firefox<\/em> button to reset the browser.<\/li>\n<\/ul>\n
Follow these steps to reset Microsoft Edge:<\/strong><\/p>\n
- \n
- Launch Microsoft Edge<\/em> and click on the three dots in the top-right area.<\/li>\n
- After the menu opens, select Settings<\/em>.<\/li>\n
- Go to the left side of the Settings<\/em> page and select “Reset Settings<\/em>.”<\/li>\n
- Go to the right and click on “Restore settings to their default values<\/em>.”<\/li>\n
- Click on Reset<\/em> to confirm and start the action.<\/li>\n<\/ul>\n
Once resetting your browser’s settings, you can try accessing the website again to check if the TLS handshake failure is gone.\u00a0 If the TLS issue persists, you can now consider uninstalling your browser.<\/p>\n
In some cases, the TLS handshake takes longer than usual to complete, which can cause the connection to fail\u2014a situation known as a ‘handshake timeout.’ This delay can prompt concerns about the expected duration of a typical TLS handshake.<\/p>\n
Well, it should take a few seconds. If it takes longer than a minute or two, then you might have a slow network connection. On the other hand, it\u2019s also possible that your browser is overloaded with extensions, add-ons, and other junk.<\/p>\n
\r\n\tPRO TIP<\/div>\r\nWhen this happens, you must use a reliable PC junk cleaner like Auslogics BoostSpeed.<\/a> You can use this tool to get rid of unneeded browser files easily. What\u2019s more, BoostSpeed has features that allow you to tweak non-optimal browser settings, ensuring smooth and fast operation.<\/div>\r\n\r\n Download for Free<\/a>\r\n Learn More<\/a>\r\n <\/div>\r\n<\/div>\r\n\nWhich of the solutions helped you fix the TLS handshake issue?<\/p>\n
Let us know in the comments below!<\/p>\n
FAQ<\/h2>\n
\r\n\tWhat is a TLS Handshake?<\/div>\r\n\t\r\n\t\tA TLS handshake is the initial process that takes place when your browser tries to establisha secure connection with a website\u2019s server. The TLS (Transport Layer Security) is commonly used to ensure data confidentiality, integrity, and authenticity between your computer and the remote server. It is the successor to the earlier SSL (Secure Sockets Layer) protocol.\r\n\t\t\r\n\t<\/div>\r\n<\/div>\n\r\n\tHow to Fix TLS Handshake Failed?<\/div>\r\n\t\r\n\t\tFixing the TLS Handshake Failed error involves updating your browser, making sure your date and time are correct, and tweaking some browser settings.\r\n\t\t\r\n\t<\/div>\r\n<\/div>\n - After the menu opens, select Settings<\/em>.<\/li>\n
- Click Refresh Firefox<\/em> under “Give Firefox a tune up<\/em>” once the Troubleshooting Information<\/em> screen appears.<\/li>\n
- After the menu appears, select Help<\/em>.<\/li>\n<\/ul>\n
- Click Settings<\/em> after the menu appears.<\/li>\n
- Launch Chrome<\/em> and click on the three dots in the top-right corner.<\/li>\n
- Click on Remove<\/em> under the profile you want to get rid of.<\/li>\n<\/ul>\n
- Once the Profile<\/em> menu appears, go to Other Profiles<\/em> towards the bottom and click on the gear icon (Manage Profiles<\/em>).<\/li>\n
- Launch Google Chrome<\/em> and click on the Profile<\/em> icon in the top-right corner. It’s next to the three dots.<\/li>\n
- Go to the Profile<\/em> on the right and click the three dots.<\/li>\n
- Click on Settings<\/em> after the menu appears.<\/li>\n<\/ul>\n
- Type
- Once the Experiments page<\/em> (alongside its warning) displays, go to the search box and type
- Now, look for security.tls.version.min<\/em> and security.tls.version.max<\/em>.<\/li>\n
- Press
- After changing the TLS version, try accessing the same website again.<\/li>\n<\/ul>\n
- Scroll down until you get to the Security<\/em> section, where you can add or remove TLS protocols.<\/li>\n
- Inside the Run dialog box<\/em>, type
- Launch the Run dialog box<\/em> by pressing
- Click on Time & Language<\/em> in the left pane.<\/li>\n
- Once you\u2019re on the Settings app<\/em>, select Time & Language<\/em>.<\/li>\n
- On your keyboard, press
![\"Windows](\"https:\/\/www.auslogics.com\/en\/articles\/wp-content\/uploads\/2019\/11\/Windows-10-time-and-language.png\")
\r\n <\/div>\r\n ![\"Windows](\"https:\/\/www.auslogics.com\/en\/articles\/wp-content\/uploads\/2019\/11\/Windows-10-date-and-time.png\")
\r\n <\/div>\r\n ![\"Inetcpl.cpl](\"https:\/\/www.auslogics.com\/en\/articles\/wp-content\/uploads\/2023\/08\/Inetcpl.cpl-Windows-10.png\")
\r\n <\/div>\r\n ![\"If](\"https:\/\/www.auslogics.com\/en\/articles\/wp-content\/uploads\/2019\/11\/Internet-Properties-Advanced.png\")
\r\n <\/div>\r\n ![\"Click](\"https:\/\/www.auslogics.com\/en\/articles\/wp-content\/uploads\/2019\/11\/Windows-10-about-config.png\")
Accept the risk and continue<\/em> \" class=\"lazyload screenshots__image\">\r\n <\/div>\r\n ![\"Enter](\"https:\/\/www.auslogics.com\/en\/articles\/wp-content\/uploads\/2019\/11\/Chrome-flags.png\")
\r\n <\/div>\r\n ![\"Type](\"https:\/\/www.auslogics.com\/en\/articles\/wp-content\/uploads\/2023\/08\/1.-Type-Manage-HTTPS-in-the-settings-search-bar.png\")
\r\n <\/div>\r\n ![\"Click](\"https:\/\/www.auslogics.com\/en\/articles\/wp-content\/uploads\/2023\/08\/Windows-10-Certificates.png\")
\r\n <\/div>\r\n ![\"Click](\"https:\/\/www.auslogics.com\/en\/articles\/wp-content\/uploads\/2023\/08\/Microsoft-Edge-Settings.png\")
\r\n <\/div>\r\n ![\"Select](\"https:\/\/www.auslogics.com\/en\/articles\/wp-content\/uploads\/2019\/11\/Access-Profiles-in-Edge.png\")
\r\n <\/div>\r\n ![\"Click](\"https:\/\/www.auslogics.com\/en\/articles\/wp-content\/uploads\/2019\/11\/Remove-profile-from-Firefox.png\")
\r\n <\/div>\r\n ![\"Select](\"https:\/\/www.auslogics.com\/en\/articles\/wp-content\/uploads\/2019\/11\/How-to-remove-a-profile-in-FireFox.png\")
\r\n <\/div>\r\n ![\"Select](\"https:\/\/www.auslogics.com\/en\/articles\/wp-content\/uploads\/2019\/11\/FireFox-Help.png\")
\r\n <\/div>\r\n