Secure Connection Failed in Firefox: what it means and how to fix it

7 min readUpdated Oct 2026

Secure Connection Failed is the page Firefox shows when it could not set up an encrypted connection to a site at all. It is a heading, not a diagnosis: the cause is in the error code under it, such as PR_END_OF_FILE_ERROR or SSL_ERROR_RX_RECORD_TOO_LONG. This page explains how to read the code, what to try as a visitor, and what the site's owner has to fix. It is part of the SSL errors section.

Quick facts

Browser: Firefox on desktop and Android
Exact text: Secure Connection Failed with An error occurred during a connection to example.com and an error code
What failed: the connection or the TLS handshake, usually before any certificate was checked
Can you click through: no; Firefox offers no exception for this page
Who fixes it: either side; the code and one network test tell which

Where to find the error code

The code is on the page itself, after the words Error code:. On some versions it appears only after you click Advanced. Everything below depends on it, so read it before trying fixes.

Firefox has two different error pages, and it matters which one you see. Secure Connection Failed means the encrypted connection never started. Warning: Potential Security Risk Ahead means the connection worked and the site's certificate failed a check, for example SEC_ERROR_UNKNOWN_ISSUER or SEC_ERROR_EXPIRED_CERTIFICATE. That second page is covered on Your connection is not private, which treats the same certificate problems across browsers.

The error codes and what they mean

The error codes and what they mean
Error code	What it usually means	Where to read more
`PR_END_OF_FILE_ERROR`	the connection was closed during the handshake, often by security software, a proxy or a VPN	below
`SSL_ERROR_RX_RECORD_TOO_LONG`	the server answered on the HTTPS port with something that is not TLS, usually plain HTTP	below
`PR_CONNECT_RESET_ERROR`	something reset the connection, typically a firewall or filter	below
`SSL_ERROR_NO_CYPHER_OVERLAP`	no cipher suite both sides accept	cipher mismatch
`SSL_ERROR_UNSUPPORTED_VERSION`	the server offers only old TLS versions	cipher mismatch, TLS versions

PR_END_OF_FILE_ERROR

The connection ended in the middle of the handshake: Firefox sent its opening message and the other side closed the connection without a usable answer. Firefox cannot tell who closed it, so the cause is usually found by elimination.

Most often it is something on the visitor's side that intercepts encrypted connections: antivirus HTTPS scanning, a VPN, a proxy configured in Firefox or in the system, or a corporate filter. Less often the server itself closes connections for a hostname it has no configuration for, or a front end such as a load balancer cannot reach the server behind it.

As a visitor: try another network first. If the site works on mobile data, the first network or software on the device is the cause. Then turn off the VPN, the antivirus web scanning and any proxy for a moment, one at a time.
As the site owner: if the site fails from several networks, test the handshake from outside with openssl s_client, shown below. A connection closed without any reply points at the server, or at whatever answers on port 443 in front of it.

SSL_ERROR_RX_RECORD_TOO_LONG

Firefox expected the start of a TLS handshake and received something much longer that it could not read as TLS. In practice this means plain HTTP is answering on the HTTPS port. The cause is on the server almost every time.

The usual configuration mistakes: in nginx, the listen 443 line is missing the ssl parameter; in Apache, the virtual host on port 443 lacks SSLEngine on; or a proxy forwards port 443 to a backend that speaks only HTTP. The fixes are on installing on nginx and installing on Apache. The same fault appears in Chrome as ERR_SSL_PROTOCOL_ERROR.

A visitor sees it on the visitor's side only in one case: a proxy configured in Firefox that does not handle HTTPS properly. If the site works in another browser on the same device, check Firefox's connection settings.

PR_CONNECT_RESET_ERROR

The connection was reset before or during the handshake. Something between Firefox and the site actively refused it, usually a firewall, a content filter or the filtering of a school or workplace network. Trying another network shows quickly whether the block is local.

Fixes for visitors

Work through these in order. Each takes a minute, and the first one alone separates the visitor's side from the site's side.

Try another network. Switch from Wi-Fi to mobile data, or the reverse. If the site loads there, the cause is the first network or software on your device.
Check the date and time. Set them to update automatically. A clock far from the real time breaks secure connections in several ways.
Turn off HTTPS scanning in antivirus software for a moment. If the site loads, leave scanning on and add an exception for the site, or update the product.
Turn off a VPN or proxy. In Firefox, the proxy is under Settings, Network Settings. If no proxy is intended, choose No proxy or Use system proxy settings.
Try with DNS over HTTPS turned off. It sits under Settings, Privacy & Security. Mozilla lists it among the causes of these errors. If turning it off fixes the site, the DNS provider in that setting is the problem, not the feature.
Undo changed TLS settings. If preferences starting with security.tls or security.ssl3 were changed on about:config, reset them to their defaults.

Do not lower the minimum TLS version to open a site. It weakens every connection the browser makes and does not fix the site.

If the site fails on another network and another device, only its owner can fix it.

How the site owner diagnoses it

Test from outside the server, against the hostname visitors use:

$ openssl s_client -connect example.com:443 -servername example.com </dev/null
$ curl -v https://example.com/

wrong version number from either tool means plain HTTP on port 443, the SSL_ERROR_RX_RECORD_TOO_LONG case. A connection closed with no reply means the server or a front end refused the handshake, the PR_END_OF_FILE_ERROR case; check the server's logs and the configuration for that hostname. An alert such as protocol version or handshake failure points at versions and ciphers, covered on cipher mismatch. More commands are on OpenSSL commands, and reading handshake alerts is on SSL handshake failed.

In Chrome and Safari

Chrome does not use the words "Secure Connection Failed". Its equivalent page says This site can't provide a secure connection, with codes such as ERR_SSL_PROTOCOL_ERROR and ERR_SSL_VERSION_OR_CIPHER_MISMATCH. Safari shows a sentence without a code; see Safari can't establish a secure connection.

FAQ

What does Secure Connection Failed mean in Firefox?

Firefox could not set up an encrypted connection to the site. The error code on the page names the reason, for example PR_END_OF_FILE_ERROR for a connection closed during the handshake or SSL_ERROR_RX_RECORD_TOO_LONG for plain HTTP on the HTTPS port.

How do I fix Secure Connection Failed?

Try another network first. If the site works there, check antivirus HTTPS scanning, a VPN or proxy, DNS over HTTPS and the device clock. If it fails everywhere, the site's owner must fix the server.

Can I bypass Secure Connection Failed?

No. Firefox offers no exception for this page, because no secure connection exists to accept. The certificate warning page, Warning: Potential Security Risk Ahead, is the one with an Accept the Risk button.

What is PR_END_OF_FILE_ERROR?

The connection was closed during the handshake. Security software, a VPN or a proxy is the usual cause on the visitor's side; on the server side, a missing configuration for the hostname or a failing front end.

What causes SSL_ERROR_RX_RECORD_TOO_LONG?

The server sends plain HTTP on port 443. In nginx the listen line lacks ssl; in Apache the virtual host lacks SSLEngine on.

Is Secure Connection Failed the same as Your connection is not private?

No. Secure Connection Failed means the encrypted connection never started. A certificate problem appears on a different Firefox page, Warning: Potential Security Risk Ahead, and in Chrome as Your connection is not private.