21

I am trying to proxy requests to a remote server, this is how I configure my Nginx

upstream myupstream {
  server remote-hostname;
}

...

location ~ ^/(v1|v2|v3)/.*$ {

    proxy_pass https://myupstream;

    # also tried these options:
    # proxy_ssl_server_name on;
    # proxy_ssl_verify off;
    # proxy_set_header Host <remote-hostname-here>;
    # proxy_set_header X_FORWARDED_PROTO https;
}

As a result I see error 502 page and this record in error.log

2018/11/10 19:41:38 [error] 8410#8410: *1 SSL_do_handshake() failed 
(SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number) 
while SSL handshaking to upstream, client: 127.0.0.1, server: <my-web-host-here>, 
request: "GET /v1/some/page HTTP/1.1", 
upstream: "https://<my-web-host-ip-here>:80/v1/some/page", 
host: "<my-web-host-here>"

What could cause this?

Note: This nginx proxy is on my local machine.

3 Answers 3

20
upstream: "https://<my-web-host-ip-here>:80/v1/some/page", 

It is not really clear to me what you are trying to achieve. But it is very unlikely that you have a HTTPS server on port 80. Port 80 is commonly used by HTTP not HTTPS. Trying to access it by HTTPS will usually result in a HTTP error response by the server which, when interpreted as the expected TLS handshake response, will result in strange error messages like ssl3_get_record:wrong version number.

4
  • 5
    Thanks mate! I added port to upstream configuration server remote-hostname:443; and that fixed the issue as you sugested! I thought that since I am already specifying https:// in proxy_pass https://myupstream; it is enough for Nginx to figure out the correct port, but apparently this is not the case and I didn't notice that port 80 in the log entry. So thank you very much, good catch!
    – Pavel
    Nov 11, 2018 at 6:40
  • Thanks for this! How ridiculous that you have to specify a port when the port can and should be inferred from the protocol (i.e. 443 for HTTPS) which is no specified here in upstream but in location.
    – Marc
    Mar 15, 2019 at 13:51
  • 1
    @Marc: upstream defines servers within the context of this directive it is not clear in which context (http vs https) it will be used later. Each server defined still needs a port though but since the context is known not it cannot be have some default which will fit all cases. Currently the port is explicitly documented as 80 by default as can be seen from this documentation. Yes, it is unexpected if the inner working are not known but I would not call it ridiculous since it is kind of clear why it works this way. Mar 15, 2019 at 14:05
  • There's always a reason for weird stuff, the result is you work around it and end up with inelegant code/configuration (as in this case). Doesn't mean grumpy people like me can't rant about it. I can't see any reason why, when a port is not specified, it can't default to 443 for HTTPS as is the standard on the web. Breaks nothing, saves duplication of configuration.
    – Marc
    Mar 18, 2019 at 19:54
20

I also met this issue and it took me 2 days to fix it.

Steffen is correct, incorrect port in upstream can cause this problem, but in my case the upstream port is correct, I have the following configuration.

location / {
            proxy_pass $scheme://$host:$server_port;
}

I found that the upstream is always resolved to IP address in error log file, instead of domain name, this can cause the same issue if the upstream is running multiple servers/domains with the same IP, I added the following directive in the configuration to force that upstream is always resolved to FQDN.

        proxy_ssl_server_name on;

the issue was gone after this change.

1
  • 1
    worked for me, thanks!
    – Evgeny
    Oct 26, 2021 at 1:51
0

In our case to proxy old CentOS repositories we had to fix SNI for the upstream so the CDN knows where to route the request:

location / {
    proxy_pass      https://vault.centos.org:443;
    proxy_ssl_name vault.centos.org;
    proxy_ssl_server_name on;
}

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.