1 Answer
- Newest
- Most votes
- Most comments
5
The error wrong version number is a classic indicator that the client (OpenSSL) expected an encrypted TLS response, but the server responded with unencrypted plain text (HTTP).
The technical cause
When you see this with AWS/ACM, it usually isn't a problem with the certificate itself, but a protocol mismatch at the Edge location or Load Balancer:
- HTTP vs HTTPS: The server is likely sending an HTTP error page or a redirect over Port 443. OpenSSL sees the "H-T-T-P" characters, doesn't recognize them as a TLS version, and throws this error.
- CloudFront Misconfiguration: Check your Origin Protocol Policy. If CloudFront is trying to connect to your origin via HTTP while expecting HTTPS (or vice versa), the handshake will fail.
- SNI Requirement: Ensure that the client supports SNI and that CloudFront is correctly associated with the ACM certificate for that specific CNAME.
Verification: Run your OpenSSL command again and look at the -debug output. If you see HTTP/1.1 or <html> in the hex dump of the server's response, the server is incorrectly serving plain text on a secure port.
Hope this helps!
If my answer was helpful, I would appreciate it if you could mark it as the accepted answer.