error:0A000126:SSL routines::unexpected eof while reading

The openssl CLI prints "<thread id>:error:0A000126:SSL routines::unexpected eof while reading:<source>"; curl wraps it as "curl: (56) OpenSSL SSL_read: … unexpected eof while reading, errno 0", Python as "[SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol".

OpenSSL 3 — SSL_R_UNEXPECTED_EOF_WHILE_READING (peer closed the TCP connection without close_notify)

What it means

The peer closed the TCP connection without first sending the TLS close_notify alert, while OpenSSL was still waiting for data (during the handshake or mid-stream). OpenSSL 3 reports this as an error because a silent close is indistinguishable from an attacker truncating the stream; OpenSSL 1.1.1 reported it only through the system-call error path.

Why it happens

• The server refused or dropped the connection

  common

  Servers that close handshakes they do not like (unknown SNI, no common version) instead of sending an alert, or that crash or time out mid-response.

• A firewall, proxy or load balancer cut the connection

  common

  Idle timeouts, connection limits and TLS-filtering firewalls end TCP connections without a TLS shutdown.

• A legacy peer that never sends close_notify

  occasional

  Some embedded servers and old implementations close the socket after every response without a TLS shutdown; with OpenSSL 3 every such response ends in this error.

How to fix it

1. 1.

   Find out when the connection ends

   If the error appears before any certificate is shown, the server or network refused the handshake; if it appears after data, the peer or a middlebox cut the stream.

   # During the handshake (no certificate printed) -> the server or network refused the connection
   # After data was exchanged -> the peer stopped mid-stream
   echo | openssl s_client -connect api.example.com:443 -servername api.example.com -state 2>&1 | grep -E 'SSL_connect|error'

2. 2.

   Legacy peers you control: SSL_OP_IGNORE_UNEXPECTED_EOF

   OpenSSL 3 can treat a silent close as a normal end of stream. Use it only for specific legacy peers where the protocol itself detects truncation (for example Content-Length), since it disables truncation detection.

   # Only for peers you control that close without close_notify (legacy embedded servers):
   # OpenSSL 3 option SSL_OP_IGNORE_UNEXPECTED_EOF, exposed by Python 3.10+ as ssl.OP_IGNORE_UNEXPECTED_EOF
   import ssl
   ctx = ssl.create_default_context()
   ctx.options |= ssl.OP_IGNORE_UNEXPECTED_EOF   # truncation is then no longer detected

3. 3.

   Fix the peer: shut TLS down properly

   Sending close_notify before closing removes the error for all clients.

   Server code: call SSL_shutdown() (or the library's close/unwrap) before closing the socket,
   and delimit HTTP responses with Content-Length or chunked encoding.

← Browse the full signature error database