1408F10B nginx protocol_error ai_generated true

SSL_read() 失败（SSL：错误：1408F10B：SSL 例程：ssl3_get_record：版本号错误）读取客户端请求时

SSL_read() failed (SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number) while reading client request

ID: nginx/ssl-read-error-connection-reset-by-peer

其他格式: JSON · Markdown 中文 · English
85%修复率
88%置信度
1证据数
2023-06-15首次发现

版本兼容性

版本状态引入弃用备注
nginx 1.18.0 active — — —
nginx 1.20.1 active — — —
nginx 1.24.0 active — — —
nginx 1.25.3 active — — —

根因分析

客户端向启用了 SSL 的端口发送非 SSL 流量，通常是由于代理或负载均衡器配置错误，将纯 HTTP 转发到了 HTTPS 监听器。

English

Client sends non-SSL traffic to an SSL-enabled port, typically due to misconfigured proxy or load balancer forwarding plain HTTP to an HTTPS listener.

generic

官方文档

https://nginx.org/en/docs/http/configuring_https_servers.html

解决方案

  1. Ensure the upstream proxy or load balancer forwards HTTPS to the same SSL port. In AWS ALB, set protocol to HTTPS. For HAProxy, use 'mode tcp' with SSL termination or configure 'option httpchk' with SSL. Check nginx error log for client IP and verify traffic source.
  2. Add a separate HTTP server block on port 80 to redirect or reject plain HTTP traffic, preventing misrouted requests from reaching the SSL server block. Example:
server {
    listen 80;
    return 301 https://$host$request_uri;
}

无效尝试

常见但无效的做法:

  1. Regenerate SSL certificate and key 90% 失败

    The error is not about certificate validity; it's a protocol mismatch caused by plain HTTP hitting an SSL port.

  2. Increase ssl_session_cache size 95% 失败

    Session cache size does not affect protocol version negotiation; this is a connection-level issue.

  3. Disable SSL protocols like TLSv1.0 85% 失败

    The error indicates the client is not speaking SSL at all, not that it's using a disabled protocol version.