Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to set up Stunnel to server as SSL cache. Everything was smooth, and mostly it works as designed.

Then I encountered errors in log files:

 SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

Not all clients trigger that, for some strange reason. Connecting from CentOS using links - error shows up (tried multiple machines). Connecting from Ubuntu using links - no error.

Tried using wget, and all is smooth with TLSv1, but error shows up with SSLv3. At the same time, wget reports:

OpenSSL: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure

Unable to establish SSL connection.

Here is my config:

pid = /etc/stunnel/stunnel.pid
debug = 3
output = /etc/stunnel/stunnel.log



; fixing "fingerprint does not match" error

CAfile = /path/to/ssl/example.com.cabundle

Anyone has any insight as to what's happening here? Googled for multiple hours now, can't figure it out.

OpenSSL version: OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008.

Stunnel version: 4.32


Here is an output of openssl s_client -connect example.com:443 -ssl3

3897:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1086:SSL alert number 40
3897:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530:

Same with -tls1 works OK, without any errors.

share|improve this question

2 Answers 2

SSL3_GET_RECORD:wrong version number is the key. It seems that lynx on your CentOS systems isn't using SSLv3.

It'll be easier to check the exact behavior with openssl s_client:

Check what happens with just SSLv3:

openssl s_client -connect server:443 -ssl3

And with just TLS:

openssl s_client -connect server:443 -tls1
share|improve this answer
Edited the post to provide more details –  Sergey Aug 19 '11 at 17:06
Try adding -no_ticket to the SSLv3 attempt. Looks like this OpenSSL bug. –  Shane Madden Aug 19 '11 at 17:46
Hmm, shows unknown option –  Sergey Aug 19 '11 at 19:03
@Serge That's.. strange. What do you get from openssl version? –  Shane Madden Aug 19 '11 at 19:08
up vote 3 down vote accepted

Ok, problem was solved... I added this to configuration:

sslVersion = all
options = NO_SSLv2

As far as I understand, error was related to SSLv23. Now all works as expected.

share|improve this answer
I also needed to add fips = no –  Steve Tauber Nov 20 '14 at 12:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.