# SSL_do_handshake() failed (SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number) while SSL handshaking to upstream

- **ID:** `nginx/ssl-handshake-failed-on-upstream`
- **Domain:** nginx
- **Category:** protocol_error
- **Verification:** ai_generated
- **Fix Rate:** 85%

## Root Cause

Upstream server is not speaking SSL/TLS but nginx is configured to use HTTPS for the proxy_pass.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| nginx 1.24.0 | active | — | — |
| nginx 1.25.3 | active | — | — |
| nginx 1.26.0 | active | — | — |
| OpenSSL 1.1.1w | active | — | — |
| OpenSSL 3.0.12 | active | — | — |

## Workarounds

1. **Change proxy_pass from https:// to http:// if upstream does not support SSL. Example:
  location /api/ {
      proxy_pass http://backend:8080/;
  }** (95% success)
   ```
   Change proxy_pass from https:// to http:// if upstream does not support SSL. Example:
  location /api/ {
      proxy_pass http://backend:8080/;
  }
   ```
2. **Configure upstream to use SSL on the correct port (e.g., 443) and ensure the proxy_pass uses https:// and the proper port:
  upstream backend {
      server backend.example.com:443;
  }
  location / {
      proxy_pass https://backend;
  }** (85% success)
   ```
   Configure upstream to use SSL on the correct port (e.g., 443) and ensure the proxy_pass uses https:// and the proper port:
  upstream backend {
      server backend.example.com:443;
  }
  location / {
      proxy_pass https://backend;
  }
   ```

## Dead Ends

- **Restart nginx and upstream services** — The root cause is a protocol mismatch, not a service crash. Restarting does not change the proxy_pass directive. (95% fail)
- **Increase proxy_connect_timeout** — Timeout settings do not affect the SSL handshake protocol version negotiation. (100% fail)
- **Reinstall SSL certificates on nginx** — The error is about connecting to an upstream, not about nginx's own certificate. (90% fail)