go network_error ai_generated true

tls：第一条记录看起来不像 TLS 握手

tls: first record does not look like a TLS handshake

ID: go/tls-handshake-error-certificate-signed-by-unknown-authority

其他格式: JSON · Markdown 中文 · English
88%修复率
82%置信度
1证据数
2024-01-10首次发现

版本兼容性

版本状态引入弃用备注
go1.20 active — — —
go1.21 active — — —
go1.22 active — — —
go1.23 active — — —

根因分析

服务器在预期端口上未使用 TLS 通信，通常是因为它使用纯 HTTP 或其他协议，或者客户端连接到了错误的端口。

English

The server is not speaking TLS on the expected port, often because it's using plain HTTP or a different protocol, or the client is connecting to the wrong port.

generic

官方文档

https://pkg.go.dev/crypto/tls#Conn.Handshake

解决方案

  1. Verify the server's protocol: use curl -v http://host:port to check if it's plain HTTP, then switch to http:// instead of https://
  2. If the server uses a non-standard TLS port, configure the correct port in the URL

无效尝试

常见但无效的做法:

  1. Adding InsecureSkipVerify: true to the TLS config 95% 失败

    This only skips certificate verification, not the protocol mismatch; the server still doesn't speak TLS.

  2. Setting a custom RootCAs pool 90% 失败

    Certificate authority configuration doesn't fix the fundamental protocol issue.

  3. Using a different TLS version like TLS 1.3 85% 失败

    The error is about the initial handshake record, not the version negotiation.