How to Fix PR_END_OF_FILE_ERROR in Firefox

First, find out whose problem it is

Open the same website in another browser, and on another device that uses a different network, for example your phone on mobile data. You can also test it with our free SSL Checker.

• Other browsers and devices fail too: the server or its network is at fault. Chrome and Edge do not show PR_END_OF_FILE_ERROR (the code comes from Firefox's own security library); they usually report ERR_CONNECTION_CLOSED or ERR_SSL_PROTOCOL_ERROR instead. Website owners, go to step 7.
• The website opens fine elsewhere: the cause is on your computer or network. Continue with step 2.
• Firefox fails on every HTTPS website: almost always a VPN, proxy or security product. Steps 2 and 3 are the most likely fixes.

Turn off your VPN and check the proxy settings

A VPN or proxy that cannot handle the connection may simply drop it, which Firefox reports as PR_END_OF_FILE_ERROR. Disconnect the VPN (or close the VPN app completely) and reload the page.

Then check the proxy setting in Firefox:

1. Open the Firefox menu and choose Settings.
2. Type proxy in the search box at the top of the Settings page and click the Settings button that appears.
3. Select No proxy, or Use system proxy settings if your company requires a proxy, and click OK.

With Use system proxy settings, Firefox follows the proxy configured in Windows or macOS, so check that too. Old VPN or "privacy" tools sometimes leave a proxy behind.

Check your antivirus, firewall and network

Many security products inspect HTTPS traffic. The feature is called "HTTPS scanning", "SSL scanning", "encrypted connection scanning" or "web shield". When it cannot handle a connection, it may close it instead of passing it on.

1. Turn the HTTPS scanning feature off for a moment and reload the page.
2. If the page opens, turn the feature back on and update the security software, or add the website as an exception. Do not leave your protection switched off.

Company, school and hotel networks can also filter traffic and drop such connections. Try mobile data or another network. On a company computer, ask your IT team first.

Test Firefox in Troubleshoot Mode

Extensions can intercept or block connections. Open the Firefox menu, choose Help → Troubleshoot Mode... and click Restart. Firefox starts with extensions and themes disabled.

• The page opens in Troubleshoot Mode: an extension is the likely cause. Restart Firefox normally, open about:addons, disable all extensions and turn them back on one by one to find the one that causes the error.
• The error stays: Troubleshoot Mode does not undo changed preferences, so continue with step 5.

Reset changed TLS settings in about:config

Tweaking guides and "hardening" tools sometimes change Firefox's TLS versions or turn off cipher suites. If the server cannot agree with the remaining settings, the handshake fails.

1. Type about:config in the address bar, press Enter and click Accept the Risk and Continue.
2. Tick Show only modified preferences next to the search box. Changed preferences are shown in bold.
3. Look for security.tls.version.min, security.tls.version.max and any entry that starts with security.ssl3.. Click the reset arrow at the end of each such row to restore the default.

The defaults are 3 for security.tls.version.min (TLS 1.2) and 4 for security.tls.version.max (TLS 1.3).

Since Firefox 132, the TLS greeting also includes a post-quantum key share, which makes it larger. Some old firewalls and inspection devices drop such connections. As a temporary test only, set security.tls.enable_kyber to false. If that helps, the network device needs an update; reset the preference afterwards.

Refresh your Firefox profile

If nothing has helped so far, your Firefox profile may hold broken settings or leftovers from old extensions. Type about:support in the address bar and click Refresh Firefox....

A refresh keeps your bookmarks, history, passwords, cookies and form data, but removes extensions, themes and modified preferences. The old profile is saved in an "Old Firefox Data" folder on your desktop; delete it when you no longer need it, because it contains personal data.

Solutions for website owners

If visitors see the error in every browser, the server or a device in front of it closes the connection during the handshake. Start by testing the handshake from outside your own network:

openssl s_client -connect example.com:443 -servername example.com

A healthy server returns its certificate chain. If the output says "no peer certificate available" and the handshake has read 0 bytes, the server hung up without answering. Then check these causes:

1. The port does not speak TLS. Port 443 must lead to a service that is configured for HTTPS. A service that accepts the connection and closes it silently causes this error, while one that answers in plain HTTP causes SSL_ERROR_RX_RECORD_TOO_LONG. Check port forwarding, firewall rules and the listening ports of your web server.
2. A virtual host has no certificate. Every HTTPS virtual host needs a certificate, including the default one that answers unknown names. On Nginx, a listen 443 ssl server block without a certificate fails the handshake, and the error log says no "ssl_certificate" is defined in server listening on SSL port while SSL handshaking. Add the certificate and key, or define a default server that has them.
3. No common TLS version or cipher. Some servers close the connection instead of sending an error message when they cannot agree with the browser. Enable TLS 1.2 and TLS 1.3 with modern cipher suites; see ERR_SSL_VERSION_OR_CIPHER_MISMATCH.
4. A client certificate is required. If the server is set up for mutual TLS, browsers without a client certificate may be disconnected. Limit client authentication to the paths or hostnames that need it.
5. A load balancer, proxy or firewall drops the connection. Check the device that terminates TLS: its connection limits, TLS settings and certificate binding (bindings sometimes break after a renewal). If the error comes and goes under load, check the server logs for worker, memory or file-descriptor limits.

After each change, restart the web server and test again with the SSL Checker. To stop certificate renewals and reinstalls from breaking your HTTPS setup, Automated SSL issues, installs and renews certificates for you.