# ERR_SSL_VERSION_OR_CIPHER_MISMATCH on a Cloudflare site (certificate not issued / multi-level subdomain)

**Code:** `ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Cloudflare)` · **Category:** Cloudflare · **Seen on:** Cloudflare

Cloudflare has no edge certificate for the hostname — the Universal SSL cert is still pending, or the hostname is a second-level subdomain (a.b.example.com) not covered.

## Meaning

Universal SSL covers example.com and *.example.com only. dev.api.example.com needs Advanced Certificate Manager or a total TLS setup. Newly added zones need minutes to hours for issuance; CAA records can block it.

## Common causes

- Multi-level subdomain (a.b.example.com) not covered by Universal SSL
- Certificate still being issued after adding the zone
- CAA records not allowing Cloudflare’s CAs
- Universal SSL disabled

## Quick fix

1. Use a first-level subdomain or order an Advanced certificate
2. Wait for issuance; check SSL/TLS → Edge Certificates
3. Fix CAA records to allow Cloudflare’s CAs

## Detailed fix by platform

### Shell

1. 

```bash
dig +short CAA example.com
openssl s_client -connect dev.api.example.com:443 -servername dev.api.example.com </dev/null 2>&1 | head -5
```


## How to diagnose

1. **Hostname** — Levels deep?
2. **Certificates** — Edge Certificates status
3. **CAA** — Records present?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/cloudflare/universal-ssl-subdomain-not-covered)