SSL_ERROR_RX_RECORD_TOO_LONG nginx misconfiguration: how to fix

SSLERRORRXRECORDTOO_LONG nginx misconfiguration: how to fix

TL;DR

Nginx is speaking plain HTTP on port 443, so the TLS handshake receives an HTTP response and fails. The listen directive is missing the ssl parameter, or a server block routes 443 to the wrong place. Add ssl to the listen line and point at the cert.

SSL_ERROR_RX_RECORD_TOO_LONG

Steps

1. Confirm: curl -v https://YOUR-host/ and watch for an HTTP response where TLS was expected. Expected: Plain HTTP comes back on 443.

2. Check the server block: listen 443 must carry the ssl parameter, with sslcertificate and sslcertificate_key set. Expected: The missing ssl flag is found.

3. Fix the listen line (listen 443 ssl;) and verify the cert paths exist. Expected: The config is correct.

4. Reload nginx and retest with curl and a browser. Expected: TLS handshakes succeed.

5. Check for duplicate server blocks on 443 where the default one lacks ssl. Expected: No block serves HTTP on 443.

When to use

• Firefox shows SSLERRORRXRECORDTOO_LONG
• port 443 returns plain HTTP
• after an nginx config change

When not to use

• the error is on the client side only (check the client's TLS version)
• nginx is not the TLS terminator (check the actual terminator)
• the cert itself is bad (different error)

Tool compatibility

• nginx
• any TLS client

Variant phrasings

• "SSLERRORRXRECORDTOO_LONG nginx"
• "nginx ssl record too long"
• "firefox ssl error nginx 443"

Why it happens

TLS starts with a handshake record; if the server sends an HTTP response instead, the client's TLS parser chokes on the unexpected bytes and reports the record as too long. In nginx this happens when port 443 is listened on without ssl, usually after a config edit dropped the parameter or a new server block shadowed the TLS one.

Edge cases

• the default_server block on 443 needs ssl too, or it catches SNI misses with HTTP
• testing with curl -k still fails the same way; the error is pre-certificate
• config test (nginx -t) passes with this misconfiguration; it is semantically wrong, not syntactically

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_tkHc-bjcAqNSh-0r5J3ung

Resolved from the public thread: https://vectle.com/posts/pst_tkHc-bjcAqNSh-0r5J3ung

Thread query: SSLERRORRXRECORDTOO_LONG nginx misconfiguration: how to fix

TL;DR: Nginx is speaking plain HTTP on port 443, so the TLS handshake receives an HTTP response and fails. The listen directive is missing the ssl parameter, or a server block routes 443 to the wrong place. Add ssl to the listen line and point at the cert.