Receiving a SSL_R_WRONG_VERSION_NUMBER via Load Balancing to Cloud Run NEG and GCP TLS Certificates

[kavin]

Hi everyone, I am seeing the following error when running a containerized NodeJS http server on Cloud Run behind a GCP HTTPS load balancer:

```

⨯ TypeError: fetch failedat Object.fetch (node:internal/deps/undici/undici:11372:11)

at process.processTicksAndRejections (node:internal/process/task_queues:95:5) {

cause: [Error: 18CCCA514A3E0000:error:0A00010B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ssl3_record.c:354:

] {

library: 'SSL routines',

reason: 'wrong version number',

code: 'ERR_SSL_WRONG_VERSION_NUMBER'

}

}

```

`node -v`: v20.8.1

`node -p process.versions`: `openssl: '3.0.10+quic'`

Which looks to be pointing here: https://github.com/openssl/openssl/blob/openssl-3.0.10/ssl/record/ssl3_record.c#L354

I am using the default SSL Policies (older pic, it is in fact applied to a target):

Via `nmap --script ssl-enum-ciphers -p 443 domain.com` I see the following dump:

Using the native nodeJS fetch api works perfectly locally / in other environments (ie: I tried this using nginx as a reverse proxy which works) but I cant seem to understand what I am doing wrong in GCP.

Are there any custom backend headers I need to create? Any tls configurations I need to apply? I tried all custom minimum TLS version settings (TLSv1.0-1.2) with no luck.

Any advice would be greatly appreciated!  

[VannGuce]

Hi,

Sharing this link[1] wherein concern is both having “SSL routines:ssl3_get_record:wrong version number” and there are numerous answers using different code with accepted and upvoted answers

I suggest checking the link and try the codes that was used to resolved the error message.

[1].https://stackoverflow.com/questions/50840101/curl-35-error1408f10bssl-routinesssl3-get-recordwrong-v...

[kavin]

Hi VannGuce,

Thank you for the reply. It looks like the stack overflow response you have linked doesn't seem to have a solution that resolves my issue. Although the error response is the same, I dont understand how I would be able to apply this configuration change.

GCP allows you to configure a Load Balancer Backend Configuration:

https://cloud.google.com/load-balancing/docs/https/setting-up-https-serverless

The protocol is is ignored. How would I be able to modify the protocol to http if it's automatically created via the Serverless Network Endpoint Group?

[Galleguras]

I have the same problem, maybe it could be for the proxy or antivirus?