{
  "id": "nginx/ssl-handshake-failed-on-upstream",
  "signature": "SSL_do_handshake() failed (SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number) while SSL handshaking to upstream",
  "signature_zh": "SSL握手失败（SSL例程：ssl3_get_record：版本号错误）在与上游进行SSL握手时",
  "regex": "SSL_do_handshake\\(\\) failed.*wrong version number.*while SSL handshaking to upstream",
  "domain": "nginx",
  "category": "protocol_error",
  "subcategory": null,
  "root_cause": "Upstream server is not speaking SSL/TLS but nginx is configured to use HTTPS for the proxy_pass.",
  "root_cause_type": "generic",
  "root_cause_zh": "",
  "versions": [
    {
      "version": "nginx 1.24.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "nginx 1.25.3",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "nginx 1.26.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "OpenSSL 1.1.1w",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "OpenSSL 3.0.12",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "Restart nginx and upstream services",
      "why_fails": "The root cause is a protocol mismatch, not a service crash. Restarting does not change the proxy_pass directive.",
      "fail_rate": 0.95,
      "condition": "",
      "sources": []
    },
    {
      "action": "Increase proxy_connect_timeout",
      "why_fails": "Timeout settings do not affect the SSL handshake protocol version negotiation.",
      "fail_rate": 1.0,
      "condition": "",
      "sources": []
    },
    {
      "action": "Reinstall SSL certificates on nginx",
      "why_fails": "The error is about connecting to an upstream, not about nginx's own certificate.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Change proxy_pass from https:// to http:// if upstream does not support SSL. Example:\n  location /api/ {\n      proxy_pass http://backend:8080/;\n  }",
      "success_rate": 0.95,
      "how": "Change proxy_pass from https:// to http:// if upstream does not support SSL. Example:\n  location /api/ {\n      proxy_pass http://backend:8080/;\n  }",
      "condition": "",
      "sources": []
    },
    {
      "action": "Configure upstream to use SSL on the correct port (e.g., 443) and ensure the proxy_pass uses https:// and the proper port:\n  upstream backend {\n      server backend.example.com:443;\n  }\n  location / {\n      proxy_pass https://backend;\n  }",
      "success_rate": 0.85,
      "how": "Configure upstream to use SSL on the correct port (e.g., 443) and ensure the proxy_pass uses https:// and the proper port:\n  upstream backend {\n      server backend.example.com:443;\n  }\n  location / {\n      proxy_pass https://backend;\n  }",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "Change proxy_pass from https:// to http:// if upstream does not support SSL. Example:\n  location /api/ {\n      proxy_pass http://backend:8080/;\n  }",
    "Configure upstream to use SSL on the correct port (e.g., 443) and ensure the proxy_pass uses https:// and the proper port:\n  upstream backend {\n      server backend.example.com:443;\n  }\n  location / {\n      proxy_pass https://backend;\n  }"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass",
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.88,
  "fix_success_rate": 0.85,
  "resolvable": "true",
  "first_seen": "2024-03-15",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}