What does ERR_SSL_PROTOCOL_ERROR mean?

The browser and the server could not set up a secure connection. Usually the server has no working certificate for that exact address (common right after moving hosts or adding www or a subdomain), Cloudflare or a CDN is half set up, port 443 is serving plain HTTP, or the server only offers old TLS versions. If it fails on only one computer, check that computer's clock, antivirus HTTPS scanning and VPN.

How do I fix 'This site can't provide a secure connection' on my website?

Test the site on a phone off Wi-Fi and with SSL Labs. Then issue the host's free Let's Encrypt or AutoSSL certificate for both the bare domain and www after DNS points at the host, set Cloudflare to Full (strict) with proxied records, or have the host enable TLS 1.2 and 1.3.

Do I need to buy an SSL certificate to fix it?

No. A free Let's Encrypt or Cloudflare certificate gives the same encryption. The error means the certificate is missing or misconfigured for that address, not that it is too cheap.

More fixes

"This site can't provide a secure connection" (ERR_SSL_PROTOCOL_ERROR)

Customers type your address and Chrome shows "This site can't provide a secure connection. example.com sent an invalid response. ERR_SSL_PROTOCOL_ERROR" (Firefox says SSL_ERROR_RX_RECORD_TOO_LONG, Safari "cannot establish a secure connection"). It is not the red "not private" warning about an expired certificate: here the browser and your server could not even agree how to talk securely. Almost always the server has no working certificate for that exact address, or something in front of it (Cloudflare, a CDN, a new host) is set up halfway.

What the visitor sees

https://www.harborbakery.example

What the checks found

Find out which case it is (ten minutes)

Is it everyone, or one computer? Open the site on your phone with Wi-Fi turned off. If it loads there, the problem is the one computer or network: a wrong date and time on the computer, antivirus "HTTPS scanning", a VPN, or an office firewall. If it fails on the phone too, it is the site.
Does http:// (no s) load? If the plain address works and only https:// fails, the site itself is up and only the certificate side is missing or broken.
Did anything change recently? A move to a new host, a domain pointed somewhere new, Cloudflare switched on, or a new www or shop subdomain. Most of these errors start within a day of one of those.
Run a free outside test. ssllabs.com/ssltest (Qualys SSL Labs) on the exact address. "No secure protocols supported", "Certificate name mismatch" or "Unable to connect to the server" each point at a case in the table below. From a terminal, curl -vI https://example.com prints where the handshake stops.
Check both names. Test example.com and www.example.com separately. Often one has a certificate and the other was never added.

The fixes, by case

No certificate on the new host: in the host's panel (cPanel "SSL/TLS Status", Plesk "SSL It!", or the host's own SSL page) issue the free Let's Encrypt or AutoSSL certificate for the domain and its www name. It can only be issued after the domain's DNS points at this host, so after a move wait for DNS, then run it. Most hosts finish in minutes.
Cloudflare in front: in SSL/TLS, Overview, use Full (strict) when the host has a certificate (issue one first, or install Cloudflare's free Origin Certificate on the host). Make sure the DNS records for both the bare name and www are proxied (orange cloud) so Cloudflare's own certificate covers them. A deeper name like shop.www.example.com is not covered by Cloudflare's free certificate.
Port 443 answering in plain HTTP: that is what "sent an invalid response" and Firefox's RX_RECORD_TOO_LONG usually mean on a VPS. The web server is listening for HTTPS without a certificate configured. Ask the host, or on your own server add the certificate to the site's HTTPS block (Certbot does this for Apache and Nginx) and restart the web server.
An old server that only speaks old TLS: current browsers refuse TLS 1.0 and 1.1. SSL Labs shows which versions the server offers. The host needs to enable TLS 1.2 and 1.3, or the site needs a current hosting plan.
One computer only: set the date and time to automatic, turn off the antivirus's HTTPS or web scanning for a test, disconnect the VPN, and clear the browser's SSL state (Windows: Internet Options, Content, Clear SSL state).
Test: load both https://example.com and https://www.example.com on a phone off Wi-Fi, and run SSL Labs again. A grade A or B with no name mismatch means it is fixed for everyone.

What you see, what it means, what it needs

What you see	What it means	Usual fix
Started right after a move or DNS change	The new host has no certificate for the name yet	Issue the free certificate for both names once DNS points there
Only www (or only the bare name) fails	The certificate covers one name, not both	Reissue it covering both, or redirect the missing name
Cloudflare is on, error on a subdomain	The record is not proxied, or the name is too deep for the free certificate	Proxy the record; keep names one level deep, or add a certificate for it
Firefox: SSL_ERROR_RX_RECORD_TOO_LONG	Port 443 is serving plain HTTP	Configure the certificate in the server's HTTPS site and restart it
SSL Labs: "No secure protocols supported"	Server offers only TLS 1.0/1.1 or nothing	Host enables TLS 1.2 and 1.3
Works on the phone, fails on one PC	Clock, antivirus, VPN or network on that PC	Fix the clock, turn off HTTPS scanning, try without the VPN

What not to do

Do not tell customers to "click through" or use http://. Forms, logins and card payments on a page without a working certificate are exactly what browsers are warning about, and Chrome labels those pages "Not secure".
Do not buy an expensive certificate to fix this. The free Let's Encrypt or Cloudflare certificate is the same encryption; the error is about it being missing or misconfigured, not about its price.
Do not switch Cloudflare to "Flexible" as a quick fix on a WordPress site. It often trades this error for an endless redirect loop and leaves the hop to your host unencrypted.

Most of these are one button in the host panel or one Cloudflare setting. If it is a server you run yourself, or the host keeps saying everything is fine, that is what the box below is for. Related: "Not secure" and certificate warnings, too many redirects and site unreachable or DNS errors.