Fix ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY in Chrome

This guide fixes the Chrome error ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY, which appears when a website uses HTTP/2 but its encryption settings are too weak for Chrome’s security requirements. The fix is usually applied on the server, but you can also work around it in your browser for testing. This article covers both approaches, starting with the fastest browser-side solution.

What You’ll Need

• Access to the website’s server configuration (cPanel, SSH, or hosting control panel) if you own the site
• Ability to edit server configuration files (Apache, Nginx, or LiteSpeed)
• An SSL/TLS certificate already installed on the server (the error is not about a missing certificate)
• Chrome browser (the fix steps are for Chrome, but the server-side fix applies to all browsers)

Step-by-Step

Quick Browser Workaround (for testing or immediate access)

1. Open Chrome and type chrome://flags in the address bar, then press Enter.
2. In the search box at the top, type HTTP/2.
3. Find the flag labeled Enable HTTP/2 (or HTTP/2 support). It is usually set to Default or Enabled.
4. Change it to Disabled using the drop-down menu on the right.
5. Click the Relaunch button that appears at the bottom of the page. Chrome will restart with the flag applied.
6. Try loading the website again. If it works, the site’s server is using outdated TLS settings. Re-enable the flag afterward to restore normal HTTP/2 behavior for other sites.

Proper Server-Side Fix (if you control the website)

1. Identify your web server software. The configuration file location depends on whether you use Apache, Nginx, or LiteSpeed. Check your hosting control panel or ask your host if unsure.
2. Open the SSL/TLS configuration file. For Apache, this is usually httpd.conf or a virtual host file. For Nginx, it is typically the nginx.conf or a site-specific file in /etc/nginx/sites-available/.
3. Find the SSL protocol settings. Look for a line like SSLProtocol (Apache) or ssl_protocols (Nginx).
4. Disable TLS 1.0 and TLS 1.1. Change the line to only allow TLS 1.2 and TLS 1.3. For Apache, use: SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1. For Nginx, use: ssl_protocols TLSv1.2 TLSv1.3;
5. Update the cipher suite list. Chrome requires strong ciphers. Add this line for Apache: SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305. For Nginx, add: ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
6. Save the file and restart your web server. Use the command sudo systemctl restart apache2 (or nginx for Nginx). On shared hosting, use the “Restart” button in your control panel.
7. Clear Chrome’s SSL cache. Go to chrome://settings/security, scroll to “Advanced,” and click “Manage certificates.” Then go to chrome://net-internals/#ssl and click “Clear session data.” Restart Chrome.
8. Test the site again. If the error persists, check that your certificate chain is complete (all intermediate certificates are installed).

Common Mistakes

• Disabling HTTP/2 globally: Turning off HTTP/2 in Chrome flags affects all sites, slowing down every HTTPS connection. Only use this as a temporary test.
• Only changing the protocol version: Updating TLS versions without updating the cipher list often leaves the error in place. Both must be changed together.
• Forgetting to restart the server: Configuration changes do not take effect until the web server is restarted or reloaded.
• Editing the wrong config file: Many servers have multiple virtual host files. Make sure you edit the one for the affected domain, not the default config.
• Using outdated cipher strings: Copy-pasting old cipher lists from forums may include weak ciphers that Chrome still rejects. Use the recommended modern list above.

Tips

• Test before and after: Use an online SSL checker to verify your TLS configuration before making changes, then again after. This confirms the fix worked without relying on Chrome alone.
• Use a staging environment: If you have a test copy of the site, apply the server changes there first to avoid downtime on the live site.
• Keep TLS 1.2 as a minimum: TLS 1.3 is preferred, but TLS 1.2 is still secure and widely supported. Do not disable it unless you are certain all visitors use modern browsers.
• Check the certificate chain: An incomplete chain (missing intermediate certificate) can trigger this error even with correct protocols. Use your hosting panel’s “SSL/TLS” section to verify the chain is complete.
• Back up config files: Before editing, copy the original file (e.g., cp nginx.conf nginx.conf.bak) so you can revert quickly if something breaks.

Troubleshooting

If the error still appears after the server fix:

• Clear Chrome’s cache and cookies: Go to chrome://settings/clear-browser-data, select “Cached images and files” and “Cookies,” then click “Clear data.” Restart Chrome.
• Check for a CDN or proxy: If your site uses Cloudflare, CloudFront, or another CDN, the TLS settings on the CDN’s edge servers matter too. Log into the CDN dashboard and check the TLS/SSL settings there.
• Verify the certificate is not expired: An expired certificate will cause a different error, but sometimes the messages overlap. Check the certificate’s validity dates in your hosting panel.
• Try a different browser: Firefox and Safari may show a more specific error message that helps pinpoint the issue (e.g., “TLS version too old”).
• Check Chrome’s internal logs: Visit chrome://net-export/ to record a log while loading the page, then open it with the netlog viewer to see the exact TLS handshake failure reason.

If disabling HTTP/2 in flags does not load the site:

• Re-enable the flag and try the server-side fix instead. The flag workaround only works if the server still supports HTTP/1.1, which most do.
• Check if the site is down for everyone: Use a website status checker from another network (e.g., your phone’s mobile data) to rule out a local network issue.

Frequently Asked Questions

What exactly causes ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY?
Chrome refuses to use HTTP/2 when the server’s TLS configuration uses protocols or ciphers that are considered weak. Specifically, TLS 1.0 or TLS 1.1, or cipher suites that do not support forward secrecy (like RC4 or 3DES), trigger this error.

Is this error dangerous?
It is not a virus or malware. It means the website’s encryption is outdated and could be vulnerable to interception. Chrome blocks the connection to protect your data, not because your computer is infected.

Can I fix this without touching the server?
Yes, the browser flag workaround (disabling HTTP/2) will let you view the site, but it forces the site to use HTTP/1.1, which is slower. The proper fix requires server-side changes.

Why does the site work in Firefox but not Chrome?
Firefox is more lenient with older TLS versions and ciphers. It may allow HTTP/2 with TLS 1.1, while Chrome requires TLS 1.2 or higher. This is a Chrome-specific security policy.

How long does the server fix take?
If you have direct access to the config files, the change takes about 10 minutes including a server restart. On shared hosting, you may need to open a support ticket, which can take a few hours to a day.

Will disabling HTTP/2 in Chrome affect other websites?
Yes, it disables HTTP/2 for all sites, which can make loading slower on many modern websites. Only keep it disabled temporarily while testing, then re-enable it.

Related

• Computer Freezes When Printing? Fix It Now
• How to Translate Text in Microsoft Office
• WhatsApp iPad: Setup Guide That Works