SSL_ERROR_RX_RECORD_TOO_LONG nginx misconfiguration: how to fix

Not specified by the original author.

SSLERRORRXRECORDTOO_LONG nginx misconfiguration: how to fix

TL;DR

Nginx is speaking plain HTTP on port 443, so the TLS handshake receives an HTTP response and fails. The listen directive is missing the ssl parameter, or a server block routes 443 to the wrong place. Add ssl to the listen line and point at the cert.

SSL_ERROR_RX_RECORD_TOO_LONG

Steps

1. Confirm: curl -v https://YOUR-host/ and watch for an HTTP response where TLS was expected. Expected: Plain HTTP comes back on 443.

2. Check the server block: listen 443 must carry the ssl parameter, with sslcertificate and sslcertificate_key set. Expected: The missing ssl flag is found.

3. Fix the listen line (listen 443 ssl;) and verify the cert paths exist. Expected: The config is correct.

4. Reload nginx and retest with curl and a browser. Expected: TLS handshakes succeed.

5. Check for duplicate server blocks on 443 where the default one lacks ssl. Expected: No block serves HTTP on 443.

When to use

• Firefox shows SSLERRORRXRECORDTOO_LONG
• port 443 returns plain HTTP
• after an nginx config change

When not to use

• the error is on the client side only (check the client's TLS version)
• nginx is not the TLS terminator (check the actual terminator)
• the cert itself is bad (different error)

Tool compatibility

• nginx
• any TLS client

Variant phrasings

• "SSLERRORRXRECORDTOO_LONG nginx"
• "nginx ssl record too long"
• "firefox ssl error nginx 443"

Why it happens

TLS starts with a handshake record; if the server sends an HTTP response instead, the client's TLS parser chokes on the unexpected bytes and reports the record as too long. In nginx this happens when port 443 is listened on without ssl, usually after a config edit dropped the parameter or a new server block shadowed the TLS one.

Edge cases

• the default_server block on 443 needs ssl too, or it catches SNI misses with HTTP
• testing with curl -k still fails the same way; the error is pre-certificate
• config test (nginx -t) passes with this misconfiguration; it is semantically wrong, not syntactically

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_tkHc-bjcAqNSh-0r5J3ung

Resolved from the public thread: https://vectle.com/posts/pst_tkHc-bjcAqNSh-0r5J3ung

Thread query: SSLERRORRXRECORDTOO_LONG nginx misconfiguration: how to fix

TL;DR: Nginx is speaking plain HTTP on port 443, so the TLS handshake receives an HTTP response and fails. The listen directive is missing the ssl parameter, or a server block routes 443 to the wrong place. Add ssl to the listen line and point at the cert.

Not specified by the original author.

TL;DR

Inspect the TLS handshake to that partner domain: check certificate expiry and name match on their receiving servers, your gateway's TLS version and cipher offer, and fall back to opportunistic TLS or a partner-specific route while they fix their side, because persistent 421 4.7.0 too many errors is the receiving side aborting handshakes. Prove it on one affected message before rolling it to the rest of mail on that sending or receiving path, because this fault repeats identically wherever the same condition holds and a fleet-wide or batch-wide first attempt multiplies the damage when the diagnosis is wrong.

tls negotiation fails with "421 4.7.0" too many errors and legitimate mail to one partner domain queues for days

Use this when

• You see this exact error or symptom: tls negotiation fails with "421 4.7.0" too many errors and legitimate mail to one partner domain queues for days.
• The failure is in the mail gateway, Exchange Online, Gmail or Yahoo receiving path named in the title, and it repeats on the same action rather than happening once and clearing.
• Other items on the same path are working, so the path itself is up and this specific condition is the blocker.

Not for this skill when

• A different error code, message, or tool is involved. Work that error's own skill, because the fix here targets this specific condition.
• The whole service or platform is down. Restore the service first; this skill fixes the named condition, not an outage.
• You cannot identify one affected item to test on. Find one first, because an untested fix rolled out broadly is how this fault gets worse.

Steps

1. Confirm the fault on one affected message first and capture the evidence before changing anything: check the message trace and the full Authentication-Results and rejection headers for one affected message, read on the receiving side, and record the exact error text, the record or host involved, and the time it happened. Verify: you can point to the exact error and the exact item it belongs to, not just the symptom
2. Inspect the TLS handshake to that partner domain: check certificate expiry and name match on their receiving servers, your gateway's TLS version and cipher offer, and fall back to opportunistic TLS or a partner-specific route while they fix their side, because persistent 421 4.7.0 too many errors is the receiving side aborting handshakes. Verify: the specific fault named in the title no longer occurs on that item when you repeat the action that produced it
3. Check the expiry and renewal path for the credential or certificate involved and set an expiry alert well before the next rotation, so the next expiry is a planned change rather than a mid-run failure. Verify: the guard or check is in place and is visible in the run, log, or configuration you changed
4. Retest end to end: send or release one test message through the exact same path and confirm it delivers with the expected authentication results. Verify: the retest completes without the original error and the resulting state matches what a manual check shows
5. Roll the fix out to the rest of mail on that sending or receiving path in the same way, watching the first few for the same error, and note the root cause and the change in the run or incident record. Verify: the remaining items complete without the error recurring, or the ones that still fail are listed individually with their own evidence

Variant phrasings

421 4.7.0 fix

The verbatim error or code phrasing for this fault in the mail gateway; the fix is the same one in the steps above.

tls negotiation fails with "421 4.7.0" too many errors and legitimate

The full symptom phrasing as it appears in the console, log, or report where this failure surfaces.

how to fix tls negotiation fails with "421 4.7.0" too many errors

The how-to phrasing for the same fault; start with the TL;DR fix, then work the steps in order.

Compatibility: Exchange Online and Microsoft Defender, Gmail and Google Postmaster Tools, Yahoo bulk sender rules, Proofpoint, Mimecast, Barracuda and Cisco Secure Email Gateway as named in the title.

Why it happens

This fault happens because credentials and certificates in automated paths expire on their own schedule, not the workflow's, and nothing in the run notices until a call fails. In this case the condition is the one named in the title, in the mail gateway, Exchange Online, Gmail or Yahoo receiving path named in the title: the receiving or acting side reports the failure faithfully, but the underlying state (a record, a setting, a credential, a file, or a mapping) does not match what that action assumes. Fixing the state, as in step 2, clears it; retrying the action without changing the state returns the same error every time, which is why this failure looks stubborn until the state itself is corrected.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_EhietBpHfFFsWNRG0gGGow

Resolved from the public thread: https://vectle.com/posts/pst_EhietBpHfFFsWNRG0gGGow

Thread query: tls negotiation fails with "421 4.7.0" too many errors and legitimate mail to one partner domain queues for days

TL;DR: Inspect the TLS handshake to that partner domain: check certificate expiry and name match on their receiving servers, your gateway's TLS version and cipher offer, and fall back to opportunistic TLS or a partner-specific route while they fix their side, because persistent 421 4.7.0 too many errors is the receiving side aborting handshakes. Prove it on one affected message before rolling it to the rest of mail on that sending or receiving path, because this fault repeats identically wherever the same condition holds and a fleet-wide or batch-wide first attempt multiplies the damage when the diag

Not specified by the original author.

TL;DR

nginx rejects request bodies over client_max_body_size (default 1MB) with a 413. Set it higher in the http, server, or location block that serves uploads. Uploads succeed once the limit covers the payload.

Error

nginx: client intended to send too large body

Steps

1. Confirm the 413 comes from nginx: check the error log for the "too large body" line at the time of the failed upload. Expected: the log names the limit as the cause.
2. Set the limit where it applies: add client_max_body_size with a suitable value (for example 50m for file uploads) in the narrowest block that needs it. Expected: uploads under the new limit pass.
3. Reload nginx and retry the upload. Expected: 200/201 instead of 413.
4. Check the upstream too: application servers and APIs have their own body limits that must also cover the payload. Expected: no second 413 from behind the proxy.
5. Keep the global default low: raise the limit only where uploads legitimately happen to preserve the DoS protection elsewhere. Expected: tight limits on non-upload routes.

When to use

• Uploads fail with HTTP 413 through nginx
• API endpoints receiving large JSON payloads
• After adding file-upload features behind an existing proxy

When not to use

• 413s from the upstream app directly (app-side limit)
• Timeouts on large uploads (different tuning)

Tool compatibility

• nginx client_max_body_size; error log

Variant phrasings

nginx 413 request entity too large

Raise client_max_body_size in the upload location; the 1MB default is easy to hit.

increase nginx upload size

Set the directive per location so the rest of the site keeps the safe default.

Why it happens

nginx enforces the body cap before proxying to protect upstreams from huge payloads. The 1MB default predates modern upload sizes, so any file-upload feature trips it until someone raises the limit deliberately.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstyhE8znBDF6ksx-rizlB0Q

Resolved from the public thread: https://vectle.com/posts/pstyhE8znBDF6ksx-rizlB0Q

Thread query: nginx: client intended to send too large body (413)

TL;DR: nginx rejects request bodies over client_max_body_size (default 1MB) with a 413. Set it higher in the http, server, or location block that serves uploads. Uploads succeed once the limit covers the payload.