How to Fix “This Site Can’t Provide a Secure Connection” Errors

"This site can't provide a secure connection" (and similar SSL errors like ERR_SSL_PROTOCOL_ERROR) means the browser could not establish a trusted, encrypted connection to your site. The cause is nearly always the SSL certificate — missing, expired, mismatched, or misconfigured. Each is straightforward to fix.

Cause 1: No certificate, or it expired

If there is no valid certificate, the secure connection fails. Install or renew one — see installing a free SSL certificate, and if renewal is the issue, forcing AutoSSL to renew.

Cause 2: The certificate does not match the domain

A certificate issued for example.com will error on www.example.com if it does not also cover the www version. Make sure your certificate covers every hostname you use, or add a wildcard certificate for subdomains.

Cause 3: A redirect or Cloudflare misconfiguration

Forcing HTTPS before a certificate exists, or using Cloudflare's "Flexible" SSL incorrectly, produces secure-connection errors and loops. Ensure a valid certificate is installed, then set Cloudflare SSL to "Full". This overlaps with redirect loop errors.

Step-by-step

Confirm a valid, unexpired certificate is installed for the domain.
Check it covers both www and non-www.
Review Cloudflare's SSL mode if you use it.
Clear your browser cache and retest.

For other certificate messages, our guide on fixing common SSL errors covers more cases.

Frequently asked questions

My certificate is valid but I still get the error.

Check that it covers the exact hostname you are visiting (www vs non-www), and that no old certificate is cached. A browser cache clear and a retest in a private window rules out local caching.

The error appeared right after I set up Cloudflare.

Set Cloudflare's SSL mode to "Full" with a valid certificate installed on your origin. "Flexible" mode is a common source of these errors.

Is my site unsafe while this shows?

Visitors cannot connect securely, so they will be warned away — worth fixing quickly. It does not by itself mean your site is compromised; it means the encryption handshake failed.