1408F10B nginx protocol_error ai_generated true

SSL_read() failed (SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number) while reading client request

ID: nginx/ssl-read-error-connection-reset-by-peer

Also available as: JSON · Markdown · 中文
85%Fix Rate
88%Confidence
1Evidence
2023-06-15First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
nginx 1.18.0 active — — —
nginx 1.20.1 active — — —
nginx 1.24.0 active — — —
nginx 1.25.3 active — — —

Root Cause

Client sends non-SSL traffic to an SSL-enabled port, typically due to misconfigured proxy or load balancer forwarding plain HTTP to an HTTPS listener.

generic

中文

客户端向启用了 SSL 的端口发送非 SSL 流量，通常是由于代理或负载均衡器配置错误，将纯 HTTP 转发到了 HTTPS 监听器。

Official Documentation

https://nginx.org/en/docs/http/configuring_https_servers.html

Workarounds

  1. 80% success Ensure the upstream proxy or load balancer forwards HTTPS to the same SSL port. In AWS ALB, set protocol to HTTPS. For HAProxy, use 'mode tcp' with SSL termination or configure 'option httpchk' with SSL. Check nginx error log for client IP and verify traffic source. 
    Ensure the upstream proxy or load balancer forwards HTTPS to the same SSL port. In AWS ALB, set protocol to HTTPS. For HAProxy, use 'mode tcp' with SSL termination or configure 'option httpchk' with SSL. Check nginx error log for client IP and verify traffic source.
  2. 75% success Add a separate HTTP server block on port 80 to redirect or reject plain HTTP traffic, preventing misrouted requests from reaching the SSL server block. Example: server { listen 80; return 301 https://$host$request_uri; } 
    Add a separate HTTP server block on port 80 to redirect or reject plain HTTP traffic, preventing misrouted requests from reaching the SSL server block. Example:
server {
    listen 80;
    return 301 https://$host$request_uri;
}

中文步骤

  1. Ensure the upstream proxy or load balancer forwards HTTPS to the same SSL port. In AWS ALB, set protocol to HTTPS. For HAProxy, use 'mode tcp' with SSL termination or configure 'option httpchk' with SSL. Check nginx error log for client IP and verify traffic source.
  2. Add a separate HTTP server block on port 80 to redirect or reject plain HTTP traffic, preventing misrouted requests from reaching the SSL server block. Example:
server {
    listen 80;
    return 301 https://$host$request_uri;
}

Dead Ends

Common approaches that don't work:

  1. Regenerate SSL certificate and key 90% fail

    The error is not about certificate validity; it's a protocol mismatch caused by plain HTTP hitting an SSL port.

  2. Increase ssl_session_cache size 95% fail

    Session cache size does not affect protocol version negotiation; this is a connection-level issue.

  3. Disable SSL protocols like TLSv1.0 85% fail

    The error indicates the client is not speaking SSL at all, not that it's using a disabled protocol version.