SSL routines:ssl3_read_bytes:tlsv1 unrecognized name

OpenSSL 3.x prints "error:0A000458:SSL routines:ssl3_read_bytes:tlsv1 unrecognized name:…:SSL alert number 112". Java clients report the same alert as "javax.net.ssl.SSLHandshakeException: Received fatal alert: unrecognized_name".

OpenSSL (client side) — TLS alert 112 (unrecognized_name) sent by a server that does not serve the requested SNI name

What it means

The client sent a server name (SNI) that the server does not serve, and the server answered with TLS alert 112 (unrecognized_name) as a fatal alert. RFC 6066 allows servers to send this alert as a warning or as fatal; strict servers (and some appliances) treat unknown names as fatal, so the handshake ends before any certificate is shown.

Why it happens

• The server has no configuration for that name

  common

  A new host name pointed at an existing server, a renamed service, or a CNAME to a CDN or platform where the custom domain was never added.

• The client sends a different name than intended

  common

  Clients connecting through an internal alias or a load-balancer name send that alias as SNI; the server only knows the public name.

• No SNI or an address instead of a name

  occasional

  Some clients send no SNI when connecting by IP address; servers configured to require a known name refuse them.

How to fix it

1. 1.

   Find the names the server accepts

   Try the handshake with each candidate name; the ones that succeed are configured on the server.

   # Which names does the server accept?
   for n in example.com www.example.com api.example.com; do
     printf '%-20s ' "$n"
     echo | openssl s_client -connect 203.0.113.10:443 -servername "$n" -brief 2>&1 | grep -m1 -E 'Protocol version|error' || echo fail
   done

2. 2.

   Configure the missing name on the server

   Add the name to the server block (or the CDN/platform domain list) together with a certificate that covers it.

   # nginx: a server block (and certificate) for every name clients use
   server {
       listen 443 ssl;
       server_name api.example.com legacy-api.example.com;
       ssl_certificate     /etc/nginx/tls/api.fullchain.pem;
       ssl_certificate_key /etc/nginx/tls/api.key;
   }

3. 3.

   Make the client send the right name

   Keep the real host name in the URL and override only the address (curl --resolve, servername options in libraries).

   # Send the server's real name as SNI when connecting by address
   curl --resolve api.example.com:443:203.0.113.10 https://api.example.com/
   openssl s_client -connect 203.0.113.10:443 -servername api.example.com </dev/null

← Browse the full signature error database