What Causes SSL_ERROR_RX_RECORD_TOO_LONG?
When a browser initiates an HTTPS connection, it expects a binary TLS handshake message (starting with byte 0x16 for TLS Handshake). If the server is misconfigured and sends a plain-text HTTP response instead (such as HTTP/1.1 200 OK or <!DOCTYPE html>), the browser attempts to interpret the ASCII characters as a TLS record length header.
Because the ASCII values form an impossibly massive number (exceeding the standard 16,384-byte TLS record limit), Firefox triggers SSL_ERROR_RX_RECORD_TOO_LONG and Chrome displays ERR_SSL_PROTOCOL_ERROR.
How to Fix in Nginx
The most common cause in Nginx is omitting the ssl directive on port 443:
# INCORRECT (causes SSL_ERROR_RX_RECORD_TOO_LONG):
server {
listen 443;
server_name example.com;
...
}
# CORRECT:
server {
listen 443 ssl http2;
server_name example.com;
ssl_certificate /etc/ssl/certs/fullchain.pem;
ssl_certificate_key /etc/ssl/private/privkey.pem;
...
}How to Fix in Apache (httpd)
In Apache, ensure SSLEngine on is present inside the port 443 VirtualHost:
<VirtualHost *:443>
ServerName example.com
SSLEngine on
SSLCertificateFile /etc/ssl/certs/example.crt
SSLCertificateKeyFile /etc/ssl/private/example.key
SSLCertificateChainFile /etc/ssl/certs/ca-bundle.crt
</VirtualHost>⚡ Check Your Server's SSL Configuration Online
Verify your TLS handshake and certificate health instantly.
Run Free SSL Check →