curl: (35) TLS connect error: error:0A00042E:SSL routines::tlsv1 alert protocol version

Recent curl releases put "TLS connect error: " before the OpenSSL reason. OpenSSL 1.1.1 includes the function: "error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version". If the server instead picks a version the client refuses, the client reports "unsupported protocol".

curl (OpenSSL backend) — CURLE_SSL_CONNECT_ERROR, TLS alert 70 (protocol_version) received from the server

What it means

The server sent TLS alert 70 (protocol_version): none of the TLS versions curl offered is acceptable to it. The prefix "tlsv1" is only the name OpenSSL gives to alerts defined since TLS 1.0, not the version in use. Usually the server is stuck on TLS 1.0/1.1 while the client offers 1.2 and 1.3, or a client was capped below the server's minimum.

Why it happens

• The server only supports TLS 1.0 or 1.1

  common

  A modern client's ClientHello offers TLS 1.2 and 1.3 only. A server whose highest version is 1.0 or 1.1, and that understands the supported_versions extension, has nothing to choose and refuses with protocol_version.

• The client was told to use an old maximum

  occasional

  --tls-max 1.1, --tlsv1.0 with a cap, or a .curlrc line left over from debugging an old device makes curl offer versions that a current server has disabled.

• A TLS 1.3-only server meets a client capped at 1.2

  occasional

  Some hardened endpoints accept only TLS 1.3. Clients built against old libraries, or forced to TLS 1.2 by configuration, are refused with the same alert.

How to fix it

1. 1.

   Find the versions the server accepts

   Try each version with openssl s_client. The result tells you whether to fix the server (only tls1/tls1_1 accepted) or the client (it never offered the accepted version).

   for v in tls1 tls1_1 tls1_2 tls1_3; do
     printf '%s: ' "$v"
     openssl s_client -connect api.example.com:443 -servername api.example.com -"$v" </dev/null >/dev/null 2>&1 \
       && echo accepted || echo refused
   done

2. 2.

   Enable TLS 1.2 and 1.3 on the server

   Upgrade the TLS configuration (and, if necessary, the TLS library or the operating system) so the server accepts TLS 1.2 and 1.3.

   # nginx
   ssl_protocols TLSv1.2 TLSv1.3;
   # HAProxy (global section)
   ssl-default-bind-options ssl-min-ver TLSv1.2

3. 3.

   Remove version caps on the client

   Delete --tls-max and old protocol flags from scripts and .curlrc; set only a minimum, so curl can negotiate the highest version both sides support.

   grep -nE 'tls-max|tlsv1|sslv3' ~/.curlrc   # a forgotten cap in the config file
   curl --tlsv1.2 https://api.example.com/        # minimum 1.2, no maximum

← Browse the full signature error database