SSL_do_handshake() failed while SSL handshaking to upstream Nginx / Apache Origin: Edge & web server OSI layer 6 · Presentation Last updated 5 Nov 2026

Nginx: [error] SSL_do_handshake() failed (SSL: error:0A000410:SSL routines::sslv3 alert handshake failure) while SSL handshaking to upstream

Nginx couldn't complete TLS to an HTTPS backend (proxy_pass https://...), so clients get 502.

Exact message you may see SSL_do_handshake() failed (SSL: error:0A000410:SSL routines::sslv3 alert handshake failure) while SSL handshaking to upstream[error] SSL_do_handshake() failed while SSL handshaking to upstreamupstream SSL certificate verify error: (20:unable to get local issuer certificate) while SSL handshaking to upstreamSSL_do_handshake() failed (SSL: error:14094410) while SSL handshaking to upstream502 Bad Gateway SSL handshaking to upstream
Explore the map of this error Full error map →
Seen on: Nginx SSL Linux

Meaning

Typical fixes: send SNI (proxy_ssl_server_name on; and proxy_ssl_name backend.example.com;), match TLS versions/ciphers (proxy_ssl_protocols TLSv1.2 TLSv1.3;), trust the backend's CA (proxy_ssl_trusted_certificate + proxy_ssl_verify on), or provide a client cert for mTLS. Many CDNs/hosts require SNI.

Common causes

  • SNI not sent to the upstream (name-based TLS vhost)
  • TLS version/cipher mismatch
  • Upstream certificate untrusted/hostname mismatch (when verifying)
  • Upstream requires a client certificate
  • Backend speaks HTTP on that port

⚡ Quick fix

  1. proxy_ssl_server_name on; proxy_ssl_name $proxy_host;
  2. Align proxy_ssl_protocols
  3. Add proxy_ssl_trusted_certificate and proxy_ssl_verify on

Detailed fix by platform

Linux

  1. openssl s_client -connect backend:443 -servername backend.example.com </dev/null | head

How to diagnose

  1. SNI — proxy_ssl_server_name?
  2. TLS — Versions overlap?
  3. Verify — CA/hostname?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Edge & web server. Errors that are often confused with or caused by this one (click to open):

502 — HTTP 502 Bad Gateway (HTTP)502525 — Cloudflare Error 525: SSL Handshake Failed (Cloudflare)525526 — Cloudflare Error 526: Invalid SSL Certificate (Cloudflare)526no resolver defined to resolve example.com — Nginx: [error] no resolver defined to resolve api.example.com, client: 203.0.113.5 (502 when proxy_pass uses a variable) (Nginx / Apache)no resolver defined t…proxy_pass with a URI changes the path (404 from upstream) — Nginx: reverse proxy returns 404 — location /api/ { proxy_pass http://app:3000/; } strips the prefix (or keeps it) (Nginx / Apache)proxy_pass with a URI…sslv3 alert handshake failure — OpenSSL: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure (SSL alert number 40) (SSL / TLS)sslv3 alert handshake…upstream sent too big header while reading response header — Nginx: [error] upstream sent too big header while reading response header from upstream (502 Bad Gateway) (Nginx / Apache)upstream sent too big…WebSocket connection failed through Nginx (missing Upgrade headers) — Browser: WebSocket connection to 'wss://example.com/socket' failed: Error during WebSocket handshake: Unexpected response code: 400 (nginx proxy) (Nginx / Apache)WebSocket connection …SSL_do_ha…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.