Client network socket disconnected before secure TLS connection was established

With fetch() it is the cause of "TypeError: fetch failed"; npm and yarn print it inside their "request to … failed" messages. The same words with a different code (for example ETIMEDOUT) point to a timeout rather than a reset.

Node.js tls / https / fetch — code ECONNRESET during the TLS handshake

What it means

The TCP connection was closed by the other side (or something in between) after Node.js sent its ClientHello and before the TLS handshake finished. No TLS alert arrived, so Node.js cannot say why; it reports a reset with code ECONNRESET. The reason lives on the server, a proxy or a firewall, not in the certificate.

Why it happens

• A corporate proxy is required but not used (or misconfigured)

  common

  Networks that only allow outbound HTTPS through a proxy often let the TCP connect succeed and then drop the handshake. Node.js does not read HTTPS_PROXY by default, so tools that work in the browser fail here.

• A firewall or TLS filter drops the handshake

  common

  Next-generation firewalls block by SNI or by TLS fingerprint and simply close the connection; VPN clients and DNS filtering can do the same.

• The server closes handshakes it cannot serve

  occasional

  Some servers and load balancers close the connection instead of sending an alert when SNI is missing, the name is unknown or no protocol version matches.

• Overload, rate limiting or connection limits

  occasional

  Servers at their connection limit, or upstream rate limiters, reset new connections; the error then appears intermittently under load.

How to fix it

1. 1.

   Check proxy settings

   Compare the environment with what your browser uses (often a PAC file). Proxy URLs should normally be http://, and internal hosts belong in NO_PROXY.

   env | grep -i -E '^(https?|no)_proxy='
   npm config get proxy; npm config get https-proxy
   # Proxy URL with http:// and internal hosts in NO_PROXY
   export HTTPS_PROXY=http://proxy.example.net:3128 NO_PROXY=localhost,127.0.0.1,.internal.example.com

2. 2.

   Repeat the handshake with openssl s_client

   If s_client is cut off too, the problem is the network or the server; vary SNI to see whether the server needs it.

   # Same handshake without Node.js: does the server or network cut it too?
   openssl s_client -connect api.example.com:443 -servername api.example.com -brief </dev/null
   openssl s_client -connect api.example.com:443 -noservername -brief </dev/null

3. 3.

   Let Node.js use the proxy environment variables

   Recent Node.js releases honour HTTP_PROXY, HTTPS_PROXY and NO_PROXY for http, https and fetch when NODE_USE_ENV_PROXY=1 is set; libraries such as axios, got or undici's ProxyAgent have their own proxy options.

   # Node.js does not use HTTPS_PROXY by itself; recent releases can be told to
   NODE_USE_ENV_PROXY=1 HTTPS_PROXY=http://proxy.example.net:3128 node app.js

← Browse the full signature error database