SSL routines:ssl_choose_client_version:unsupported protocol

The openssl CLI prints "<thread>:error:0A000102:SSL routines:ssl_choose_client_version:unsupported protocol:<source>"; curl, Node.js and other applications show "error:0A000102:SSL routines::unsupported protocol". OpenSSL 1.1.1 used code 1425F102.

OpenSSL (client side) — SSL_R_UNSUPPORTED_PROTOCOL: the server chose a version the client does not allow

What it means

The client offered TLS 1.2 and 1.3, but the server's ServerHello selected an older version (typically TLS 1.0), which the client's OpenSSL is not allowed to use. The client aborts in ssl_choose_client_version. Old TLS stacks ignore the client's offered range and simply answer with their own version; modern stacks would refuse with a protocol_version alert instead.

Why it happens

• The server speaks only TLS 1.0 or 1.1

  common

  Unmaintained servers, old appliances and embedded devices.

• The client's OpenSSL forbids old versions

  common

  Current distributions set TLS 1.2 as the minimum (security level 2), so a server that worked from an old machine fails from a new one.

How to fix it

1. 1.

   Confirm the server's version

   Forcing TLS 1.0 at security level 0 for this one diagnostic command shows whether the server only speaks the old version.

   # Allowed only for this diagnostic command: which version does the server pick?
   echo | openssl s_client -connect legacy.example.com:443 -servername legacy.example.com \
     -tls1 -cipher 'DEFAULT:@SECLEVEL=0' -brief 2>&1 | grep -E 'Protocol version|error'

2. 2.

   Enable TLS 1.2 and 1.3 on the server

   Upgrading the server (or putting a modern TLS terminator in front) is the only durable fix.

   # Server side
   ssl_protocols TLSv1.2 TLSv1.3;     # nginx
   SSLProtocol -all +TLSv1.2 +TLSv1.3 # Apache httpd

← Browse the full signature error database