SSL routines:ssl3_read_bytes:tlsv1 alert protocol version

OpenSSL 3.0 and 3.5 both print "error:0A00042E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:<source>:SSL alert number 70"; OpenSSL 1.1.1 used code 1409442E. Clients built on OpenSSL (curl, Python, Ruby, PHP) show the same reason text.

OpenSSL (client side) — TLS alert 70 (protocol_version) received from the server

What it means

The client received TLS alert 70 (protocol_version) from the server: none of the protocol versions the client offered is acceptable to the server. "tlsv1" is only the family name OpenSSL uses for alerts defined since TLS 1.0. In practice the server is limited to TLS 1.0/1.1 while the client offers 1.2 and 1.3, or the client was restricted to versions the server has disabled.

Why it happens

• The server supports only TLS 1.0 or 1.1

  common

  Legacy appliances, old Windows/IIS or Java servers, and devices that were never updated.

• The client was told to use an old version

  occasional

  Flags like -tls1 or a MaxProtocol setting left in a configuration make the client offer versions that current servers refuse.

• A TLS 1.3-only server and a client limited to 1.2

  occasional

  Hardened endpoints sometimes accept TLS 1.3 only; old clients cannot connect.

How to fix it

1. 1.

   Find the versions the server accepts

   Try each version explicitly (security level 0 allows the SHA-1 based handshakes of TLS 1.0/1.1 for this test only).

   for v in tls1 tls1_1 tls1_2 tls1_3; do
     printf '%-7s ' "$v"
     echo | openssl s_client -connect legacy.example.com:443 -servername legacy.example.com -"$v" \
       -cipher 'DEFAULT:@SECLEVEL=0' >/dev/null 2>&1 && echo accepted || echo refused
   done

2. 2.

   Enable TLS 1.2 and 1.3 on the server

   Update the server's protocol settings (and its TLS library if it predates TLS 1.2).

   # nginx
   ssl_protocols TLSv1.2 TLSv1.3;
   # Apache httpd
   SSLProtocol -all +TLSv1.2 +TLSv1.3

← Browse the full signature error database