# SSL_read() 失败（SSL：错误：1408F10B：SSL 例程：ssl3_get_record：版本号错误）读取客户端请求时

- **ID:** `nginx/ssl-read-error-connection-reset-by-peer`
- **领域:** nginx
- **类别:** protocol_error
- **错误码:** `1408F10B`
- **验证级别:** ai_generated
- **修复率:** 85%

## 根因

客户端向启用了 SSL 的端口发送非 SSL 流量，通常是由于代理或负载均衡器配置错误，将纯 HTTP 转发到了 HTTPS 监听器。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| nginx 1.18.0 | active | — | — |
| nginx 1.20.1 | active | — | — |
| nginx 1.24.0 | active | — | — |
| nginx 1.25.3 | active | — | — |

## 解决方案

1. ```
   Ensure the upstream proxy or load balancer forwards HTTPS to the same SSL port. In AWS ALB, set protocol to HTTPS. For HAProxy, use 'mode tcp' with SSL termination or configure 'option httpchk' with SSL. Check nginx error log for client IP and verify traffic source.
   ```
2. ```
   Add a separate HTTP server block on port 80 to redirect or reject plain HTTP traffic, preventing misrouted requests from reaching the SSL server block. Example:
server {
    listen 80;
    return 301 https://$host$request_uri;
}
   ```

## 无效尝试

- **Regenerate SSL certificate and key** — The error is not about certificate validity; it's a protocol mismatch caused by plain HTTP hitting an SSL port. (90% 失败率)
- **Increase ssl_session_cache size** — Session cache size does not affect protocol version negotiation; this is a connection-level issue. (95% 失败率)
- **Disable SSL protocols like TLSv1.0** — The error indicates the client is not speaking SSL at all, not that it's using a disabled protocol version. (85% 失败率)