error:14094418 nginx protocol_error ai_generated partial

SSL_do_handshake() failed (SSL: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unexpected message) while SSL handshaking to upstream

ID: nginx/ssl-do-handshake-failed-sslv3-alert-unexpected-message

Also available as: JSON · Markdown · 中文
78%Fix Rate
85%Confidence
1Evidence
2024-06-20First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
nginx 1.24.0 active — — —
nginx 1.25.3 active — — —
nginx 1.26.0 active — — —
OpenSSL 1.1.1w active — — —
OpenSSL 3.0.13 active — — —

Root Cause

Upstream server expects a different TLS protocol version or cipher suite than what nginx is offering, often due to misconfigured SSL/TLS settings or incompatible server software.

generic

中文

上游服务器期望的TLS协议版本或密码套件与nginx提供的不同，通常是由于SSL/TLS配置错误或服务器软件不兼容。

Official Documentation

https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_protocols

Workarounds

  1. 85% success Set ssl_protocols and ssl_ciphers to match upstream requirements: proxy_ssl_protocols TLSv1.2; proxy_ssl_ciphers HIGH:!aNULL:!MD5; 
    Set ssl_protocols and ssl_ciphers to match upstream requirements: proxy_ssl_protocols TLSv1.2; proxy_ssl_ciphers HIGH:!aNULL:!MD5;
  2. 75% success Disable SSL verification for upstream if using self-signed certs: proxy_ssl_verify off; proxy_ssl_session_reuse on; 
    Disable SSL verification for upstream if using self-signed certs: proxy_ssl_verify off; proxy_ssl_session_reuse on;
  3. 80% success Use a specific cipher suite that both sides support: proxy_ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384; 
    Use a specific cipher suite that both sides support: proxy_ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;

中文步骤

  1. Set ssl_protocols and ssl_ciphers to match upstream requirements: proxy_ssl_protocols TLSv1.2; proxy_ssl_ciphers HIGH:!aNULL:!MD5;
  2. Disable SSL verification for upstream if using self-signed certs: proxy_ssl_verify off; proxy_ssl_session_reuse on;
  3. Use a specific cipher suite that both sides support: proxy_ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;

Dead Ends

Common approaches that don't work:

  1. Upgrade OpenSSL to the latest version 70% fail

    The error is not about OpenSSL version mismatch but about protocol negotiation; upgrading alone doesn't fix incompatible cipher or version settings.

  2. Set ssl_protocols TLSv1.2 TLSv1.3 on nginx side only 80% fail

    The upstream may require a specific TLS version that is not in the list; both sides must be configured consistently.

  3. Ignore the error and retry 90% fail

    The error persists until the SSL configuration is corrected; retrying without changes leads to repeated failures.