This error almost always means TLS is not actually ready at the edge, even though the service looks healthy.
First, check whether a certificate is really attached to the domain. Use an external SSL checker or openssl s_client to see if the server presents a certificate at all. If nothing comes back, the certificate was never issued or never bound to the load balancer.
Next, verify DNS. Make sure the domain resolves to the correct IP or ingress endpoint. If DNS still points to an old target, the TLS handshake will fail even though n8n is running.
Then confirm the TLS listener. Many platforms mark a domain as provisioned before HTTPS is fully wired. If HTTPS is enabled but no certificate is linked, browsers throw ERR_SSL_PROTOCOL_ERROR.
If this runs behind a reverse proxy or managed ingress, restart or reattach the domain so the platform retries certificate issuance. As a last step, delete the domain and add it again to force a fresh SSL provisioning cycle.
The key point is this is not an n8n app issue. It is a broken or incomplete certificate binding at the infrastructure or ingress layer.
https://certera.com/kb/what-is-ssl-certificate-not-trusted-error-how-to-fix-err_ssl_protocol_error/
