Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

WARNING: SSLv3 is obsolete. Consider disabling it altogether.

I'm trying to set up Stunnel to server as SSL cache. Everything was smooth, and mostly it works as designed.

Then I encountered errors in log files:

 SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

Not all clients trigger that, for some strange reason. Connecting from CentOS using links - error shows up (tried multiple machines). Connecting from Ubuntu using links - no error.

Tried using wget, and all is smooth with TLSv1, but error shows up with SSLv3. At the same time, wget reports:

OpenSSL: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure

Unable to establish SSL connection.

Here is my config:

pid = /etc/stunnel/
debug = 3
output = /etc/stunnel/stunnel.log



; fixing "fingerprint does not match" error

CAfile = /path/to/ssl/

Anyone has any insight as to what's happening here? Googled for multiple hours now, can't figure it out.

OpenSSL version: OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008.

Stunnel version: 4.32


Here is an output of openssl s_client -connect -ssl3

3897:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1086:SSL alert number 40
3897:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530:

Same with -tls1 works OK, without any errors.

share|improve this question
SSLv3 Is Comprehensively Broken – Raedwald Jun 26 '15 at 12:09
up vote 8 down vote accepted

Ok, problem was solved... I added this to configuration:

sslVersion = all
options = NO_SSLv2

As far as I understand, error was related to SSLv23. Now all works as expected.

share|improve this answer
I also needed to add fips = no – Steve Tauber Nov 20 '14 at 12:10
You can also add option = NO_SSLv3 to force one of the TLS variants to be selected. – Tedford Dec 9 '15 at 22:31

SSL3_GET_RECORD:wrong version number is the key. It seems that lynx on your CentOS systems isn't using SSLv3.

It'll be easier to check the exact behavior with openssl s_client:

Check what happens with just SSLv3:

openssl s_client -connect server:443 -ssl3

And with just TLS:

openssl s_client -connect server:443 -tls1
share|improve this answer
Edited the post to provide more details – Sergey Aug 19 '11 at 17:06
Try adding -no_ticket to the SSLv3 attempt. Looks like this OpenSSL bug. – Shane Madden Aug 19 '11 at 17:46
Hmm, shows unknown option – Sergey Aug 19 '11 at 19:03
@Serge That's.. strange. What do you get from openssl version? – Shane Madden Aug 19 '11 at 19:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.