networking quic ai_generated true

QUIC handshake failed: TLS alert handshake_failure; connection refused on UDP 443

ID: networking/quic-handshake-failed

Also available as: JSON · Markdown
85%Fix Rate
87%Confidence
35Evidence
2023-06-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

The QUIC (HTTP/3) handshake failed, typically because UDP 443 is blocked by a firewall or middlebox, the server does not support QUIC, or TLS 1.3 negotiation failed. Browsers and clients should fall back to HTTP/2 over TCP, but programmatic clients may not have automatic fallback.

generic

Workarounds

  1. 88% success Ensure UDP 443 is open in all firewalls along the path 
    1. Test UDP 443 connectivity: nc -zuv host 443
2. Check local firewall: iptables -L -n | grep 443
3. Allow UDP 443: iptables -A INPUT -p udp --dport 443 -j ACCEPT
4. In cloud environments, check security groups allow UDP 443 inbound and outbound
5. Check for middleboxes that inspect or block UDP: traceroute -U -p 443 host
6. Verify QUIC works: curl --http3 -v https://host/
  2. 92% success Configure automatic fallback from HTTP/3 to HTTP/2 over TCP 
    1. In curl: --http3 falls back automatically; use --http3-only to force (avoid this)
2. In browsers, QUIC fallback is automatic via Alt-Svc header racing
3. In programmatic clients, implement Alt-Svc parsing and fallback logic
4. On the server, ensure both HTTP/2 (TCP) and HTTP/3 (UDP) are configured
5. Set Alt-Svc header: Alt-Svc: h3=":443"; ma=86400
6. Clients that fail QUIC will use the TCP connection transparently

Dead Ends

Common approaches that don't work:

  1. Force QUIC/HTTP/3 without fallback in environments that block UDP 85% fail

    Many enterprise networks, corporate firewalls, and some ISPs block or throttle UDP traffic on port 443. Without TCP fallback, the connection fails entirely. QUIC requires UDP to function.

  2. Disable TLS certificate verification to bypass QUIC TLS errors 80% fail

    QUIC mandates TLS 1.3 and does not support unencrypted connections. Disabling verification does not fix handshake failures caused by unsupported cipher suites, protocol version mismatches, or certificate chain issues.

Error Chain

Leads to:
Preceded by:
Frequently confused with: