node-request - Getting error "SSL23_GET_SERVER_HELLO:unknown protocol"

Question

I'm using the node-request module, regularly sending GET requests to a set of URLs and, sometimes, getting the error below on some sites.

Error: 29472:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:openssl\ssl\s23_clnt.c:683

The problem is that I don't get this error always or always on the some URLs, just sometimes. Also, it can't be ignored with "strictSSL: false".

I have read that this can be related to me sending SSL requests with the wrong protocol (SSLv2, SSLv3, TLS..). But this doesn't explain why it happens irregularly.

Btw, I'm running nodejs on a Win 2008 server.

Any help is appreciated.

Superheterodyne

What happens when you retry the same urls a few seconds latter? – Garik

Few seconds later, I get no errors. The errors are only returned sometimes. – Superheterodyne

Answer 1

This was totally my bad.

I was using standard node http.request on a part of the code which should be sending requests to only http adresses. Seems like the db had a single https address which was queried with a random interval.

Simply, I was trying to send a http request to https.

Superheterodyne

The error looks more like sending https request to http port? – Bonbon

The error message shows clearly that you were using HTTPS, i.e. SSL, and that the server sent you an 'unknown protocol' message, also in SSL. You don't speak either HTTP or HTTPS to databases. Answer doesn't make sense. – Censorious

Answer 2

You will get such error message when you request HTTPS resource via wrong port, such as 80. So please make sure you specified right port, 443, in the Request options.

Brokendown

Just had this problem with docker, had in my docker-compose: ports: - "443:80" – Mitran

Answer 3

I got this error because I was using require('https') where I should have been using require('http').

Riga

Answer 4

Some of the sites are speaking SSLv2, or at least sending an SSLv2 server-hello, and your client doesn't speak, or isn't configured to speak, SSLv2. You need to make a policy decision here. SSLv2 should have vanished from the face of the earth years ago, and sites that still use it are insecure. However, if you gotta talk to them, you just have to enable it at your end, if you can. I would complain to the site owners though if you can.

Censorious

Although the error sounds like this, not sure if that is the case considering the same URL sometimes returns thiş error. Btw, in node-request, is there a way to enable both SSLv2 and SSLv3? Or, should I do this on the Wİndow OS level? – Superheterodyne

That could happen if the site is a farm and there are different SSL levels in different elements: which would be a crazy setup, but if there is SSLv2 at all it is already crazy. I can't advise you about node.js but it is clearly using OpenSSL under the hood, and OpenSSL is highly configurable. I'd investigate the sites in question first though, you don't want to be enabling SSLv2 at your end without a really good reason. – Censorious

Still couldn't identify the issue exactly. Once done, I'll be updating this entry. – Superheterodyne

@Superheterodyne 4 years on, this is still an Issue. Getting the same error. – Therese

@Therese Starting with Node v4+, I suggest using Node's default (SSLv23_method) as it it has the max compatibility in my experience. As an addition, SSLv3 support is dropped in Nodejs, so, if the website being requested expects SSLv3, that may be the issue. – Superheterodyne

Answer 5

I had this problem (403 error for each package) and I found nothing great in the internet to solve it. My .npmrc file inside my user folder was wrong and misunderstood. I changed this npmrc line from

proxy=http://XX.XX.XXX.XXX:XXX/

to :

proxy = XX.XX.XXX.XXX:XXXX

Kuban

Thank you so much! I was going crazy. This was the problem .net core too(linux) (but works in java): export http_proxy=x.x.x.x:8888 export https_proxy=x.x.x.x:8888 – Hettie

Answer 6

var https = require('https');
https.globalAgent.options.secureProtocol = 'SSLv3_method';

Quechua

did not solve my problem, but useful information tho – Bombard

SSLv3 is dangerous and obsolete ... instead use secureProtocol: "TLSv1_method" – Jacquelinjacqueline

Answer 7

I got this error while connecting to Amazon RDS. I checked the server status 50% of CPU usage while it was a development server and no one is using it.

It was working before, and nothing in the connection configuration has changed. Rebooting the server fixed the issue for me.

Ferdy

Answer 8

So in Short,

vi ~/.proxy_info

export http_proxy=<username>:<password>@<proxy>:8080
export https_proxy=<username>:<password>@<proxy>:8080

source ~/.proxy_info

Hope this helps someone in hurry :)

Beckmann

This does not explain why the suggestion could solve the problem. – Hideaway

Answer 9

in my case (the website SSL uses ev curves) the issue with the SSL was solved by adding this option ecdhCurve: 'P-521:P-384:P-256'

request({ url, 
   agentOptions: { ecdhCurve: 'P-521:P-384:P-256', }
}, (err,res,body) => {
...

JFYI, maybe this will help someone

Crumpton

Answer 10

I got this error, while using it on my rocketchat to communicate with my gitlab via enterprise proxy,

Because, was using the https://:8080 but actually, it worked for http://:8080

Cletus