# SSL_read() failed (SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number) while reading client request

- **ID:** `nginx/ssl-read-error-connection-reset-by-peer`
- **Domain:** nginx
- **Category:** protocol_error
- **Error Code:** `1408F10B`
- **Verification:** ai_generated
- **Fix Rate:** 85%

## Root Cause

Client sends non-SSL traffic to an SSL-enabled port, typically due to misconfigured proxy or load balancer forwarding plain HTTP to an HTTPS listener.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| nginx 1.18.0 | active | — | — |
| nginx 1.20.1 | active | — | — |
| nginx 1.24.0 | active | — | — |
| nginx 1.25.3 | active | — | — |

## Workarounds

1. **Ensure the upstream proxy or load balancer forwards HTTPS to the same SSL port. In AWS ALB, set protocol to HTTPS. For HAProxy, use 'mode tcp' with SSL termination or configure 'option httpchk' with SSL. Check nginx error log for client IP and verify traffic source.** (80% success)
   ```
   Ensure the upstream proxy or load balancer forwards HTTPS to the same SSL port. In AWS ALB, set protocol to HTTPS. For HAProxy, use 'mode tcp' with SSL termination or configure 'option httpchk' with SSL. Check nginx error log for client IP and verify traffic source.
   ```
2. **Add a separate HTTP server block on port 80 to redirect or reject plain HTTP traffic, preventing misrouted requests from reaching the SSL server block. Example:
server {
    listen 80;
    return 301 https://$host$request_uri;
}** (75% success)
   ```
   Add a separate HTTP server block on port 80 to redirect or reject plain HTTP traffic, preventing misrouted requests from reaching the SSL server block. Example:
server {
    listen 80;
    return 301 https://$host$request_uri;
}
   ```

## Dead Ends

- **Regenerate SSL certificate and key** — The error is not about certificate validity; it's a protocol mismatch caused by plain HTTP hitting an SSL port. (90% fail)
- **Increase ssl_session_cache size** — Session cache size does not affect protocol version negotiation; this is a connection-level issue. (95% fail)
- **Disable SSL protocols like TLSv1.0** — The error indicates the client is not speaking SSL at all, not that it's using a disabled protocol version. (85% fail)