# SSL握手失败（SSL：错误14094418：SSL例程：ssl3_read_bytes：tlsv1警报意外消息）在与上游进行SSL握手时

- **ID:** `nginx/ssl-do-handshake-failed-sslv3-alert-unexpected-message`
- **领域:** nginx
- **类别:** protocol_error
- **错误码:** `error:14094418`
- **验证级别:** ai_generated
- **修复率:** 78%

## 根因

上游服务器期望的TLS协议版本或密码套件与nginx提供的不同，通常是由于SSL/TLS配置错误或服务器软件不兼容。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| nginx 1.24.0 | active | — | — |
| nginx 1.25.3 | active | — | — |
| nginx 1.26.0 | active | — | — |
| OpenSSL 1.1.1w | active | — | — |
| OpenSSL 3.0.13 | active | — | — |

## 解决方案

1. ```
   Set ssl_protocols and ssl_ciphers to match upstream requirements: proxy_ssl_protocols TLSv1.2; proxy_ssl_ciphers HIGH:!aNULL:!MD5;
   ```
2. ```
   Disable SSL verification for upstream if using self-signed certs: proxy_ssl_verify off; proxy_ssl_session_reuse on;
   ```
3. ```
   Use a specific cipher suite that both sides support: proxy_ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;
   ```

## 无效尝试

- **Upgrade OpenSSL to the latest version** — The error is not about OpenSSL version mismatch but about protocol negotiation; upgrading alone doesn't fix incompatible cipher or version settings. (70% 失败率)
- **Set ssl_protocols TLSv1.2 TLSv1.3 on nginx side only** — The upstream may require a specific TLS version that is not in the list; both sides must be configured consistently. (80% 失败率)
- **Ignore the error and retry** — The error persists until the SSL configuration is corrected; retrying without changes leads to repeated failures. (90% 失败率)