ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY Fix

The “ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY” error in Chrome means the website’s server is using an outdated or insecure TLS configuration that Chrome refuses to connect to over HTTP/2. The fix is to update the server’s TLS settings to meet Chrome’s minimum security requirements, typically by enabling TLS 1.2 or 1.3 and using a modern cipher suite.

What Causes This Error

Chrome enforces a set of security standards for HTTP/2 connections, which require TLS 1.2 or higher and a cipher suite that provides forward secrecy (like ECDHE). When a server’s TLS configuration falls short—for example, it only supports TLS 1.0 or uses an outdated cipher like RC4—Chrome blocks the connection and shows this error. This is a client-side restriction, not a network issue, so the problem lies entirely with the server.

How Chrome Decides to Block

Chrome’s HTTP/2 implementation checks the TLS handshake against a policy that requires:

TLS version 1.2 or 1.3 (TLS 1.0 and 1.1 are considered inadequate)
A cipher suite that supports forward secrecy (e.g., ECDHE_RSA or ECDHE_ECDSA)
A valid certificate chain (no self-signed or expired certs)

If any of these fail, Chrome falls back to HTTP/1.1 in some cases, but if the server only advertises HTTP/2 (via ALPN), the connection fails entirely with this error.

How to Fix It (Server Side)

If you control the server, you need to update its TLS configuration. The exact steps depend on your web server software, but the general process is:

Enable TLS 1.2 and 1.3 – Disable TLS 1.0 and 1.1 in your server settings.
Configure a modern cipher suite – Use only suites that support forward secrecy, like those starting with ECDHE. For example, in Apache: SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256.
Restart the web server – Apply the changes and test with an online TLS checker.

If you’re using a CDN or hosting provider, you may need to adjust settings in their control panel or contact support.

What to Do If You’re Just Visiting a Site

If you’re a user encountering this error, you cannot fix it from your browser. The site’s administrator must update their server. You can try:

Refreshing the page (sometimes a temporary glitch).
Using a different browser (Firefox or Safari may be more lenient).
Contacting the site owner to report the issue.

Do not attempt to bypass the error by disabling security features—that exposes you to risks.

Common Misconception: It’s a Chrome Bug

Many people think this is a Chrome bug because it appears suddenly. In reality, Chrome periodically raises its security baseline. When a server hasn’t been updated in years, it suddenly fails. The error is intentional and protective—it prevents you from using an insecure connection.

Comparison with Similar Errors

This error is often confused with ERR_SSL_VERSION_OR_CIPHER_MISMATCH or ERR_HTTP2_PROTOCOL_ERROR. The former is about mismatched TLS versions/ciphers, while the latter is a general HTTP/2 protocol violation. The inadequate transport security error is specifically about the TLS handshake not meeting Chrome’s HTTP/2 security requirements.

Prevention for Site Owners

To avoid this error in the future, keep your TLS configuration up to date:

Use TLS 1.3 if possible (it’s faster and more secure).
Regularly test your site with SSL Labs’ SSL Server Test.
Set up automated alerts for certificate expiration.
Consider using a managed CDN that handles TLS for you.

Staying current with security best practices not only prevents this error but also improves your site’s trust and SEO.

Frequently Asked Questions

Can I fix this error by clearing my browser cache?

No. The error is server-side, so clearing cache or cookies won’t help. It’s not a local issue.

Does this error mean the site is hacked?

Not necessarily. It usually means the server is outdated, not compromised. However, an outdated server is more vulnerable, so it’s a good reason to be cautious.

Will using HTTP/1.1 instead of HTTP/2 solve it?

If the server supports HTTP/1.1, Chrome may fall back to it automatically, but if the server only offers HTTP/2, the connection fails. The real fix is updating TLS.

Is there a way to bypass the error in Chrome flags?

There is no official flag to disable this security check. Trying to bypass it would require modifying Chrome’s internals, which is not recommended and could break other security features.

Why does this error appear on some sites but not others?

Because different servers have different TLS configurations. Sites that are regularly updated won’t trigger it, while older or poorly maintained ones will.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →