Safari can't establish a secure connection: causes and fixes

Safari can't establish a secure connection means Safari could not set up an encrypted connection to the server. It shows no error code, so the cause has to be found by testing. Certificate problems usually appear on a different Safari page, This Connection Is Not Private; this one points at the connection itself: old TLS settings on the server, or a VPN, filter or profile on the device. Apps on iPhone, iPad and Mac report the same failure as An SSL error has occurred and a secure connection to the server cannot be made. It is part of the SSL errors section.

Quick facts

Browser

Safari on macOS, iOS and iPadOS

Exact text

Safari can't open the page because Safari can't establish a secure connection to the server

In apps

An SSL error has occurred and a secure connection to the server cannot be made

Error code

none on screen; apps log NSURLErrorSecureConnectionFailed (-1200)

Who fixes it

either side; the network test below tells which

What the error means

Safari distinguishes two kinds of failure. When the connection works and the certificate fails a check, because it expired, does not cover the name or comes from an untrusted issuer, Safari shows This Connection Is Not Private; see Your connection is not private. When the encrypted connection cannot be set up at all, Safari shows this message instead.

So the cause sits in the TLS handshake or in front of it. The server and Safari found no protocol version or cipher both accept, something on the network interrupted the exchange, or software on the device intercepted the connection and failed.

Other browsers name these failures with codes. Chrome reports ERR_SSL_PROTOCOL_ERROR or ERR_SSL_VERSION_OR_CIPHER_MISMATCH, and Firefox Secure Connection Failed with a code under it. On a Mac, opening the same address in one of them is the fastest way to get a precise answer.

Fixes on iPhone, iPad and Mac

Work through these in order. The first test decides whether the problem is on your side at all.

1. Switch networks. Turn Wi-Fi off and load the site on mobile data, or join another Wi-Fi network. If it works there, the first network is the cause: a public Wi-Fi login page you have not completed, a filtering router or a school or workplace network.

2. Turn off the VPN for a moment. VPN apps and filters that route traffic through themselves can break secure connections to some sites.

3. Try without iCloud Private Relay. If you use it, turn it off for that network and reload. It relays Safari's traffic, and a failure on the relay's side looks like this error.

4. Check content blockers and security apps. Software that filters traffic on the device can interrupt connections to particular sites. Disable it briefly and test again.

5. Check installed profiles. On iPhone and iPad they are listed under Settings, General, VPN & Device Management; on a Mac, search System Settings for Profiles or Device Management, since the location depends on the macOS version. A profile you do not recognise, or one left behind by software you removed, may add a filter or a proxy. On a managed device, ask its administrator rather than removing anything.

6. Update the system. Safari's TLS support comes with the operating system, so a very old version may not support what a current server requires.

If the site fails on another network and another device, the problem is at the site.

Causes on the server

• Only old TLS versions are enabled. Apple has deprecated TLS 1.0 and 1.1, and current Safari does not connect to servers that offer nothing newer. Enable TLS 1.2 and TLS 1.3; see TLS versions.

• The cipher list has nothing Safari accepts. A list limited to legacy ciphers, or one that does not suit the certificate's key type, leaves no common choice. See cipher mismatch.

• Plain HTTP answers on port 443, or the hostname has no configuration. Both break the handshake before a certificate is sent. See ERR_SSL_PROTOCOL_ERROR.

• A client certificate is required. If the endpoint uses mutual TLS and the device has no certificate it accepts, the connection fails.

Test from outside to see which applies:

$ openssl s_client -connect example.com:443 -servername example.com </dev/null
$ openssl s_client -connect example.com:443 -servername example.com -tls1_2 </dev/null

What the output means is on OpenSSL commands and SSL handshake failed.

"An SSL error has occurred" in apps

Apps on Apple devices use the same system networking as Safari, and they show this sentence when a secure connection fails. App Store, Mail and many third-party apps produce it. For a user the fixes are the same as above: another network, no VPN, no filtering profile, an updated system.

For developers, the message corresponds to NSURLErrorSecureConnectionFailed, code -1200. Apps are also bound by App Transport Security, which by default requires TLS 1.2 or later, cipher suites with forward secrecy and a certificate with a strong key and signature. A server that a browser accepts can still fail these checks. Apple documents the requirements in Preventing insecure network connections. Fix the server rather than adding exceptions to the app.

Why Safari shows no code

The message is written for people who cannot act on a code, which is most people who see it. The cost falls on whoever diagnoses the problem: Safari gives no detail, so the diagnosis comes from outside the browser.

If you support other people, two questions replace the missing code: do other sites work on that device, and does this site work on another network? The answers point at the device, the network or the site.

FAQ