Repository navigation
ssl related error @ routines:ssl3_read_bytes:sslv3 #17936
Description
Version: 9.0.3
Platform: win10 x64
Subsystem: ssl
Made a simple api https server (code's bellow). All works fine but from time to time server randomly crashes with this error:
Error: 140147404642112:error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message:../deps/openssl/openssl/ssl/s3_pkt.c:1500:SSL alert number 10
Any ideas why this happens/how to fix this? And what stands for error number 10?
Any help much appreciated.
var fs = require('fs');
var app = require('express')();
var port = 5000;
var key = fs.readFileSync('my.crt');
var cert = fs.readFileSync('my.key');
var server = require('https').Server({ 'key': privateKey, 'cert': certificate }, app);
server.listen(port, function() {
Logger.info('listening on *:'+port);
});
Activity
bnoordhuis commentedon Jan 2, 2018
Alert 10 is 'unexpected message.' The other end of the connection is saying it didn't expect something on the TLS protocol level but without going into details.
When you say "crash", you mean "throws an exception"?
jloa commentedon Jan 2, 2018
Yes. And the thing is that it happens randomly whenever a web-socket client connects to node.
uncaughtException: 140147404642112:error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message:../deps/openssl/openssl/ssl/s3_pkt.c:1500:SSL alert number 10Also i've downgraded to node version 4.4.7 and it seems like there's no such problem.
It's kinda hard to reproduce this error though - i just make constant ws connection with a timeout of 1000ms and after some time on latest node i get this exception.
Left node 4.4.7 to run for 1 hour - no errors.
Also the cert is valid and verified by GeoTrust SSL CA - G3 (not self-signed)
bnoordhuis commentedon Jan 2, 2018
v4.4.7 uses a slightly older version of openssl (1.0.2g vs. 1.0.2n) so that might explain it. Without a tcpdump or wireshark trace it's hard to say what exactly is going on.
It's probably an old or buggy TLS client but it doesn't really matter: alerts are part of the protocol, the other end can send them at almost any time for almost any reason. Log the error and move on; that's about all you can do, practically speaking.
I'll close this out. If you have follow-up questions, can you post them to the help repo? Cheers.
tls: allow enabling the TLS debug trace