{
  "id": "nginx/ssl-read-error-connection-reset-by-peer",
  "signature": "SSL_read() failed (SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number) while reading client request",
  "signature_zh": "SSL_read() 失败（SSL：错误：1408F10B：SSL 例程：ssl3_get_record：版本号错误）读取客户端请求时",
  "regex": "SSL_read\\(\\) failed \\(SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number\\) while reading client request",
  "domain": "nginx",
  "category": "protocol_error",
  "subcategory": null,
  "root_cause": "Client sends non-SSL traffic to an SSL-enabled port, typically due to misconfigured proxy or load balancer forwarding plain HTTP to an HTTPS listener.",
  "root_cause_type": "generic",
  "root_cause_zh": "客户端向启用了 SSL 的端口发送非 SSL 流量，通常是由于代理或负载均衡器配置错误，将纯 HTTP 转发到了 HTTPS 监听器。",
  "versions": [
    {
      "version": "nginx 1.18.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "nginx 1.20.1",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "nginx 1.24.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "nginx 1.25.3",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "Regenerate SSL certificate and key",
      "why_fails": "The error is not about certificate validity; it's a protocol mismatch caused by plain HTTP hitting an SSL port.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    },
    {
      "action": "Increase ssl_session_cache size",
      "why_fails": "Session cache size does not affect protocol version negotiation; this is a connection-level issue.",
      "fail_rate": 0.95,
      "condition": "",
      "sources": []
    },
    {
      "action": "Disable SSL protocols like TLSv1.0",
      "why_fails": "The error indicates the client is not speaking SSL at all, not that it's using a disabled protocol version.",
      "fail_rate": 0.85,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Ensure the upstream proxy or load balancer forwards HTTPS to the same SSL port. In AWS ALB, set protocol to HTTPS. For HAProxy, use 'mode tcp' with SSL termination or configure 'option httpchk' with SSL. Check nginx error log for client IP and verify traffic source.",
      "success_rate": 0.8,
      "how": "Ensure the upstream proxy or load balancer forwards HTTPS to the same SSL port. In AWS ALB, set protocol to HTTPS. For HAProxy, use 'mode tcp' with SSL termination or configure 'option httpchk' with SSL. Check nginx error log for client IP and verify traffic source.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Add a separate HTTP server block on port 80 to redirect or reject plain HTTP traffic, preventing misrouted requests from reaching the SSL server block. Example:\nserver {\n    listen 80;\n    return 301 https://$host$request_uri;\n}",
      "success_rate": 0.75,
      "how": "Add a separate HTTP server block on port 80 to redirect or reject plain HTTP traffic, preventing misrouted requests from reaching the SSL server block. Example:\nserver {\n    listen 80;\n    return 301 https://$host$request_uri;\n}",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "Ensure the upstream proxy or load balancer forwards HTTPS to the same SSL port. In AWS ALB, set protocol to HTTPS. For HAProxy, use 'mode tcp' with SSL termination or configure 'option httpchk' with SSL. Check nginx error log for client IP and verify traffic source.",
    "Add a separate HTTP server block on port 80 to redirect or reject plain HTTP traffic, preventing misrouted requests from reaching the SSL server block. Example:\nserver {\n    listen 80;\n    return 301 https://$host$request_uri;\n}"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://nginx.org/en/docs/http/configuring_https_servers.html",
  "official_doc_section": null,
  "error_code": "1408F10B",
  "verification_tier": "ai_generated",
  "confidence": 0.88,
  "fix_success_rate": 0.85,
  "resolvable": "true",
  "first_seen": "2023-06-15",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}