TL;DR

Chrome and Edge no longer negotiate TLS 1.0/1.1 and there is no flag to bring them back. iLO 2 (TLS 1.0) and iLO 3 (TLS 1.1 at most) will never move to TLS 1.2. What works today:

  1. Firefox, in a separate profile: about:config → security.tls.version.enable-deprecated = true.
  2. Edge in Internet Explorer mode (Windows).
  3. SSH into the iLO for anything that does not need the UI, and enforce AES while you are there:
1
2

ssh -o HostKeyAlgorithms=+ssh-rsa -o KexAlgorithms=+diffie-hellman-group14-sha1 -c aes256-cbc Administrator@<ilo-ip>
set /map1/config1 oemhp_enforce_aes=yes

Why it happens

iLOLast firmwareMax TLSCiphers it offers
iLO 22.33 (2018-03)1.0RC4-SHA, 3DES-SHA; AES-CBC if you enforce AES
iLO 31.94.2 (2020-12)1.1AES-128-CBC-SHA (DHE), 3DES

HPE put it in writing: TLS 1.2 is not supported on iLO 3 and will not be added because the G7 line is out of support. iLO 2 (G6 and earlier) is worse: TLS 1.0 and nothing else.

On the browser side:

  • Chrome and Edge removed TLS 1.0/1.1 in 2020 (Chrome 84) and the SSLVersionMin policy that could re-enable them in 2022 (Chrome 98). Against an old iLO that shows up as ERR_SSL_VERSION_OR_CIPHER_MISMATCH.
  • Firefox disabled them in 78 (2020) but kept the preference. Since 93 it also turns off 3DES, unless deprecated TLS is enabled. RC4 was removed in 44 (2016) and is not coming back. The usual error is SSL_ERROR_UNSUPPORTED_VERSION or SSL_ERROR_NO_CYPHER_OVERLAP.

The bug to remove those Firefox preferences is still open, so as of today (September 2026) this route still works.

Option 1: Firefox with deprecated TLS, in a separate profile

Do not weaken your daily browser. Create a profile just for management:

  1. about:profiles → Create a New Profile → name it ilo → Launch profile in new browser.
  2. In that profile, about:config → search security.tls.version.enable-deprecated → true.
  3. Open https://<ilo-ip>/ and accept the self-signed certificate.
  4. If it still will not negotiate, security.tls.version.min → 1 (TLS 1.0, iLO 2) or 2 (TLS 1.1, iLO 3).

When Firefox hits a TLS 1.0 site, the error page shows an Enable TLS 1.0 and 1.1 button that flips the same preference. Old recipes touched four prefs (fallback-limit, min, max, enable-deprecated); on current Firefox enable-deprecated is enough and min is the fallback.

To launch that profile later:

1

firefox -P ilo --no-remote

Option 2: Edge in Internet Explorer mode

Windows only. IE mode uses the Trident engine and the system’s Schannel, which still keeps TLS 1.0/1.1.

  1. edge://settings/defaultBrowser → Allow sites to be reloaded in Internet Explorer mode → Allow → restart Edge.
  2. Open the iLO URL → ⋯ menu → Reload in Internet Explorer mode.
  3. Edge remembers the page in IE mode for 30 days; add it to the IE mode pages list so it does not forget.

On Windows 11 24H2 and later TLS 1.0/1.1 are also off in Schannel: if IE mode still fails, enable them under Internet Options → Advanced → Use TLS 1.0 / 1.1 while you work on the iLO, and turn them off afterwards.

Option 3: from the iLO itself over SSH

SSH into the iLO still works from any OpenSSH if you ask for the old algorithms (details in SSH to legacy hosts):

1
2
3
4

ssh -o HostKeyAlgorithms=+ssh-rsa \
    -o KexAlgorithms=+diffie-hellman-group14-sha1 \
    -c aes256-cbc \
    Administrator@<ilo-ip>

Inside, two settings that help the web side:

1
2
3
4
5

# Offer AES instead of RC4/3DES (UI: Administration → Security → Encryption → Enforce AES/3DES Encryption)
set /map1/config1 oemhp_enforce_aes=yes

# New certificate (expired, hostname changed): delete the current one; the iLO resets and generates a new self-signed cert
delete /map1/sslcert1

Enforcing AES does not fix the error by itself: the problem is the TLS version, not only the cipher. What it buys you is that, once TLS 1.0/1.1 is enabled in the browser, the session uses AES-CBC and does not depend on 3DES (which Firefox only allows in deprecated mode) or RC4 (gone from every browser).

And for power, virtual media, users, and firmware you do not need the UI at all: iLO CLI commands.

What does not help

  • Updating the firmware on iLO 2/3 does not raise the TLS ceiling; just make sure you are on the last release (2.33 / 1.94.2) for the rest of the fixes. See upgrade firmware over SSH.
  • Chrome/Edge flags: none exist for TLS 1.0/1.1 since 2022.
  • An old Chrome or a Windows 7 VM with IE11 works, but it is worse than a Firefox profile: an unpatched OS plus an unpatched browser to open a management interface.

If it is an iLO 4

iLO 4 with 2.x firmware negotiates TLS 1.2 and does not have this problem. If an iLO 4 gives you ERR_SSL_VERSION_OR_CIPHER_MISMATCH, it is on 1.x firmware: update it (2.8x is the final branch) and the browser gets in with no tricks.

See also