What does ERR_SSL_VERSION_OR_CIPHER_MISMATCH mean?

The browser and the server could not agree on a secure connection. On a business website this almost always means the server has no certificate for that exact address, for example after a host move or while a Cloudflare certificate is still pending. Less often the server only supports old TLS 1.0 or 1.1.

Why does ERR_SSL_VERSION_OR_CIPHER_MISMATCH happen with Cloudflare?

Either the Cloudflare edge certificate has not been issued yet (Pending Validation, often wrong nameservers or a CAA record), or the address is two levels deep, like www.shop.example.com, which the free certificate does not cover.

How do I fix ERR_SSL_VERSION_OR_CIPHER_MISMATCH on my website?

Run the SSL Labs test to name the case. Issue a free certificate for the name with AutoSSL or Let's Encrypt once DNS points at the host, fix a pending Cloudflare certificate or grey-cloud the record, and enable TLS 1.2 and 1.3 if the server only offers older versions.

More fixes

Your site says "ERR_SSL_VERSION_OR_CIPHER_MISMATCH"

Chrome shows "This site can't provide a secure connection. The client and server don't support a common SSL protocol version or cipher suite." Edge says the same, Firefox says "SSL_ERROR_NO_CYPHER_OVERLAP". Despite the wording, it is rarely about ciphers. Almost always the server has no certificate it can offer for that exact address, so it gives up before the page starts. Here is how to tell which case you have, and the fix for each.

What the visitor sees

https://www.shop.harborbakery.example/

What the checks found

Find out which case you have

Try the address with and without www, and on a phone on mobile data. If one form works and the other fails, the certificate covers only one name. If everything fails everywhere, the server has no certificate for the domain at all. If only one computer fails, it is that computer (see the last fix).
Run the free SSL Labs server test (ssllabs.com/ssltest) on the failing address. "No secure protocols supported" or "Certificate name mismatch" names the case. A list of only TLS 1.0 / 1.1 means the server is too old for current browsers.
Is the site behind Cloudflare? Open Cloudflare > SSL/TLS > Edge Certificates. A certificate marked "Pending Validation", or none at all, means Cloudflare cannot serve the site over HTTPS yet. Also check the name: the free certificate covers example.com and *.example.com, one level only, so www.shop.example.com is not covered.
Did it start after a move? A new host, a new IP address, a domain added to a hosting account, or a change of nameservers all leave a gap where the new server has no certificate for the name yet.
If you can use a terminal: openssl s_client -connect example.com:443 -servername example.com. "no peer certificate available" or "handshake failure" confirms the server has nothing to offer for that name.

The fixes, by case

No certificate for the name on the host: in cPanel > SSL/TLS Status, tick the domain and its www form and click Run AutoSSL (or use the host's Let's Encrypt button). This only works once the domain's DNS points at this host, so fix DNS first if it does not.
Cloudflare certificate pending: check that the nameservers at the registrar are the two Cloudflare gave you, and that no CAA record in DNS blocks Cloudflare's certificate authorities. Most pending certificates issue within 15 minutes of that being right; until then, set the record to "DNS only" (grey cloud) so visitors reach the host's own certificate.
A name two levels deep under Cloudflare (www.shop.example.com): rename it to one level (shop.example.com), switch that record to "DNS only", or add an Advanced Certificate that names it.
Server offers only TLS 1.0 / 1.1: current browsers refuse both. On a managed host ask them to enable TLS 1.2 and 1.3; on your own server update OpenSSL and the web server and set ssl_protocols TLSv1.2 TLSv1.3; (nginx) or SSLProtocol -all +TLSv1.2 +TLSv1.3 (Apache).
Old cipher list: a hand-written cipher list that only allows RC4 or 3DES gets the same error. Replace it with the host's default or Mozilla's "intermediate" setting.
Only one computer fails: an antivirus "HTTPS scanning" feature, an office proxy, or a very old browser or operating system. Update the browser, turn off HTTPS scanning to test, and check the clock is right.

What you see, what it means, what it needs

What you see	What it means	Usual fix
Fails everywhere, right after a host move or new domain	The new server has no certificate for the name	Run AutoSSL / Let's Encrypt once DNS points there
Cloudflare shows "Pending Validation"	Cloudflare has not issued its certificate	Fix nameservers or CAA, or grey-cloud for now
Only `www.shop.example.com` fails	The free certificate covers one level only	Rename, grey-cloud, or an Advanced Certificate
SSL Labs lists only TLS 1.0 / 1.1	Server is too old for current browsers	Enable TLS 1.2 and 1.3
Fails on one computer only	Antivirus, proxy or an old browser	Update, turn off HTTPS scanning

What not to do

Do not tell visitors to "click through". This error has no "proceed anyway" link, and a site no one can open loses every order and enquiry until it is fixed.
Do not switch Cloudflare to "Flexible" to hide it. That does not create the missing certificate and often adds a redirect loop.
Do not buy a paid certificate first. The free one from the host or Cloudflare covers almost every small business site once the name and DNS are right.
Write down every DNS record before changing nameservers, so email and other services can be put back exactly.

Most cases are a certificate that was never issued for the name after a move, or a Cloudflare certificate still pending. If it is still failing, that is what the box below is for. Related: ERR_SSL_PROTOCOL_ERROR, "Not secure" warning, Cloudflare error, Too many redirects.