nginx protocol_error ai_generated true

SSL_do_handshake() failed (SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number) while SSL handshaking to upstream

ID: nginx/ssl-handshake-failed-on-upstream

Also available as: JSON · Markdown

85%Fix Rate

88%Confidence

1Evidence

2024-03-15First Seen

Version Compatibility

Version	Status	Introduced	Deprecated	Notes
nginx 1.24.0	active	—	—	—
nginx 1.25.3	active	—	—	—
nginx 1.26.0	active	—	—	—
OpenSSL 1.1.1w	active	—	—	—
OpenSSL 3.0.12	active	—	—	—

Root Cause

Upstream server is not speaking SSL/TLS but nginx is configured to use HTTPS for the proxy_pass.

generic

Official Documentation

https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass

Workarounds

95% success Change proxy_pass from https:// to http:// if upstream does not support SSL. Example: location /api/ { proxy_pass http://backend:8080/; }
```
Change proxy_pass from https:// to http:// if upstream does not support SSL. Example:
  location /api/ {
      proxy_pass http://backend:8080/;
  }
```
85% success Configure upstream to use SSL on the correct port (e.g., 443) and ensure the proxy_pass uses https:// and the proper port: upstream backend { server backend.example.com:443; } location / { proxy_pass https://backend; }
```
Configure upstream to use SSL on the correct port (e.g., 443) and ensure the proxy_pass uses https:// and the proper port:
  upstream backend {
      server backend.example.com:443;
  }
  location / {
      proxy_pass https://backend;
  }
```

中文步骤

Change proxy_pass from https:// to http:// if upstream does not support SSL. Example:
  location /api/ {
      proxy_pass http://backend:8080/;
  }

Configure upstream to use SSL on the correct port (e.g., 443) and ensure the proxy_pass uses https:// and the proper port:
  upstream backend {
      server backend.example.com:443;
  }
  location / {
      proxy_pass https://backend;
  }

Dead Ends

Common approaches that don't work:

Restart nginx and upstream services 95% fail
The root cause is a protocol mismatch, not a service crash. Restarting does not change the proxy_pass directive.
Increase proxy_connect_timeout 100% fail
Timeout settings do not affect the SSL handshake protocol version negotiation.
Reinstall SSL certificates on nginx 90% fail
The error is about connecting to an upstream, not about nginx's own certificate.