WARNING: SSLv3 is obsolete. Consider disabling it altogether.

I'm trying to set up Stunnel to server as SSL cache. Everything was smooth, and mostly it works as designed.

Then I encountered errors in log files:

 SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

Not all clients trigger that, for some strange reason. Connecting from CentOS using links - error shows up (tried multiple machines). Connecting from Ubuntu using links - no error.

Tried using wget, and all is smooth with TLSv1, but error shows up with SSLv3. At the same time, wget reports:

OpenSSL: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure

Unable to establish SSL connection.

Here is my config:

pid = /etc/stunnel/stunnel.pid
debug = 3
output = /etc/stunnel/stunnel.log



; fixing "fingerprint does not match" error

CAfile = /path/to/ssl/example.com.cabundle

Anyone has any insight as to what's happening here? Googled for multiple hours now, can't figure it out.

OpenSSL version: OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008.

Stunnel version: 4.32


Here is an output of openssl s_client -connect example.com:443 -ssl3

3897:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1086:SSL alert number 40
3897:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530:

Same with -tls1 works OK, without any errors.


3 Answers 3


Ok, problem was solved... I added this to configuration:

sslVersion = all
options = NO_SSLv2

As far as I understand, error was related to SSLv23. Now all works as expected.

  • I also needed to add fips = no Nov 20, 2014 at 12:10
  • You can also add option = NO_SSLv3 to force one of the TLS variants to be selected.
    – Tedford
    Dec 9, 2015 at 22:31

SSL3_GET_RECORD:wrong version number is the key. It seems that lynx on your CentOS systems isn't using SSLv3.

It'll be easier to check the exact behavior with openssl s_client:

Check what happens with just SSLv3:

openssl s_client -connect server:443 -ssl3

And with just TLS:

openssl s_client -connect server:443 -tls1
  • Edited the post to provide more details
    – Sergey
    Aug 19, 2011 at 17:06
  • Try adding -no_ticket to the SSLv3 attempt. Looks like this OpenSSL bug. Aug 19, 2011 at 17:46
  • Hmm, shows unknown option
    – Sergey
    Aug 19, 2011 at 19:03
  • @Serge That's.. strange. What do you get from openssl version? Aug 19, 2011 at 19:08

I had to set

options = -NO_SSLv3

to deactivate the now default option of NO_SSLv3. (The server connecting to doesn't do TLS)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.