Receiving a SSL_R_WRONG_VERSION_NUMBER via Load Balancing to Cloud Run NEG and GCP TLS Certificates

Google Cloud Serverless Applications
1

Hi everyone, I am seeing the following error when running a containerized NodeJS http server on Cloud Run behind a GCP HTTPS load balancer:


⨯ TypeError: fetch failedat Object.fetch (node:internal/deps/undici/undici:11372:11)

at process.processTicksAndRejections (node:internal/process/task_queues:95:5) {

cause: [Error: 18CCCA514A3E0000:error:0A00010B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ssl3_record.c:354:

] {

library: 'SSL routines',

reason: 'wrong version number',

code: 'ERR_SSL_WRONG_VERSION_NUMBER'

}

}

node -v: v20.8.1

node -p process.versions: openssl: '3.0.10+quic'

Which looks to be pointing here: https://github.com/openssl/openssl/blob/openssl-3.0.10/ssl/record/ssl3_record.c#L354

I am using the default SSL Policies (older pic, it is in fact applied to a target):

kavin_0-1697574642591.png
kavin_0-1697574642591.png822×603 65.9 KB

Via nmap --script ssl-enum-ciphers -p 443 domain.com I see the following dump:

kavin_1-1697574797464.png
kavin_1-1697574797464.png502×754 20.1 KB

Using the native nodeJS fetch api works perfectly locally / in other environments (ie: I tried this using nginx as a reverse proxy which works) but I cant seem to understand what I am doing wrong in GCP.

Are there any custom backend headers I need to create? Any tls configurations I need to apply? I tried all custom minimum TLS version settings (TLSv1.0-1.2) with no luck.

Any advice would be greatly appreciated!

2

Hi,

Sharing this link[1] wherein concern is both having “SSL routines:ssl3_get_record:wrong version number” and there are numerous answers using different code with accepted and upvoted answers

I suggest checking the link and try the codes that was used to resolved the error message.

[1].https://stackoverflow.com/questions/50840101/curl-35-error1408f10bssl-routinesssl3-get-recordwrong-version-number

3

Hi VannGuce,

Thank you for the reply. It looks like the stack overflow response you have linked doesn’t seem to have a solution that resolves my issue. Although the error response is the same, I dont understand how I would be able to apply this configuration change.

GCP allows you to configure a Load Balancer Backend Configuration:

kavin_0-1698030215432.png
kavin_0-1698030215432.png1670×1074 68.2 KB

https://cloud.google.com/load-balancing/docs/https/setting-up-https-serverless

The protocol is is ignored. How would I be able to modify the protocol to http if it’s automatically created via the Serverless Network Endpoint Group?

4

I have the same problem, maybe it could be for the proxy or antivirus?