SSL握手失败（SSL：错误14094418：SSL例程：ssl3_read_bytes：tlsv1警报意外消息）在与上游进行SSL握手时
SSL_do_handshake() failed (SSL: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unexpected message) while SSL handshaking to upstream
ID: nginx/ssl-do-handshake-failed-sslv3-alert-unexpected-message
版本兼容性
| 版本 | 状态 | 引入 | 弃用 | 备注 |
|---|---|---|---|---|
| nginx 1.24.0 | active | — | — | — |
| nginx 1.25.3 | active | — | — | — |
| nginx 1.26.0 | active | — | — | — |
| OpenSSL 1.1.1w | active | — | — | — |
| OpenSSL 3.0.13 | active | — | — | — |
根因分析
上游服务器期望的TLS协议版本或密码套件与nginx提供的不同，通常是由于SSL/TLS配置错误或服务器软件不兼容。
English
Upstream server expects a different TLS protocol version or cipher suite than what nginx is offering, often due to misconfigured SSL/TLS settings or incompatible server software.
官方文档
https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_protocols解决方案
-
Set ssl_protocols and ssl_ciphers to match upstream requirements: proxy_ssl_protocols TLSv1.2; proxy_ssl_ciphers HIGH:!aNULL:!MD5;
-
Disable SSL verification for upstream if using self-signed certs: proxy_ssl_verify off; proxy_ssl_session_reuse on;
-
Use a specific cipher suite that both sides support: proxy_ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;
无效尝试
常见但无效的做法:
-
Upgrade OpenSSL to the latest version
70% 失败
The error is not about OpenSSL version mismatch but about protocol negotiation; upgrading alone doesn't fix incompatible cipher or version settings.
-
Set ssl_protocols TLSv1.2 TLSv1.3 on nginx side only
80% 失败
The upstream may require a specific TLS version that is not in the list; both sides must be configured consistently.
-
Ignore the error and retry
90% 失败
The error persists until the SSL configuration is corrected; retrying without changes leads to repeated failures.