# Redis: Error: write EPROTO ... SSL routines:ssl3_get_record:wrong version number / Connection reset by peer (TLS vs plaintext)

**Code:** `Redis TLS: SSL handshake error / protocol mismatch` · **Category:** Redis · **Seen on:** Redis, SSL, Node.js

The client and server disagree about TLS — plaintext client to a TLS port, or TLS client to a plaintext port.

## Meaning

Managed Redis (ElastiCache in-transit encryption, Azure Cache 6380, Upstash, Redis Cloud) requires TLS: use `rediss://` and the right port, or `tls: {}` option. Self-hosted TLS needs `tls-port`, certificates, and the CA on the client. Plain clients to a TLS port get "connection reset"/EPROTO.

## Common causes

- `redis://` used against a TLS endpoint (needs `rediss://`)
- TLS enabled client against plaintext server
- CA cert not trusted / hostname mismatch
- Wrong port (6379 vs 6380)
- Missing `tls-auth-clients` cert for mTLS

## Quick fix

1. Use `rediss://` and the TLS port
2. Provide `tls: { ca, servername }` if using a private CA
3. Match client and server TLS settings

## Detailed fix by platform

### Linux

1. `redis-cli --tls -h HOST -p 6380 --cacert ca.crt ping`

## How to diagnose

1. **Scheme** — rediss?
2. **Port** — TLS port?
3. **CA** — Trusted?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/redis/redis-tls-handshake-error-ssl-required)