/errors/openssl/wrong-version-number
SSL routines::wrong version number (error:0A00010B)
- tool
- OpenSSL
- exit code
- 1
- versions
- OpenSSL 1.1.1, OpenSSL 3.x
- os
- linux, macos, windows
wrong version number (OpenSSL error 0A00010B, in OpenSSL 1.1.1 SSL3_GET_RECORD:wrong version number) means OpenSSL sent a TLS ClientHello and the bytes that came back are not a TLS record. TLS records start with a content type and a version; plain HTTP starts with HTTP/1.1 400, which OpenSSL reads as an invalid version. In practice: you are talking TLS to a port that does not speak TLS. Use http://, the right port, or the protocol's STARTTLS mode.
Reproduce it
A plain HTTP server on port 4305, contacted with TLS:
node -e 'require("http").createServer((q, r) => r.end("plain http\n")).listen(4305, "127.0.0.1"); setTimeout(() => process.exit(0), 3000)' &
sleep 1
openssl s_client -connect 127.0.0.1:4305 </dev/null 2>&1 | grep -o 'SSL routines:[^:]*:wrong version number'
curl -s http://127.0.0.1:4305/
waitOutput
SSL routines:tls_validate_record_header:wrong version number plain http
The same port answers fine over plain HTTP. Tools built on OpenSSL report the same error in their own wrapper: curl prints curl: (35) ... wrong version number, Python ssl.SSLError: [SSL: WRONG_VERSION_NUMBER] wrong version number, git fatal: unable to access ... error:0A00010B:SSL routines::wrong version number.
Common situations
| You ran | Problem | Fix |
|---|---|---|
| curl https://localhost:3000 | dev server without TLS | curl http://localhost:3000 |
| https_proxy=https://proxy:3128 | proxy speaks plain HTTP | https_proxy=http://proxy:3128 |
| openssl s_client -connect mail:587 | port 587 needs STARTTLS | openssl s_client -starttls smtp -connect mail:587 |
Check what the port speaks
curl -v http://host:port/ # an HTTP answer means plain HTTP
openssl s_client -connect host:443 -brief # a working TLS port prints the protocol and cipher