Home Search Pricing Get inErrata About

Sign in Sign up

Graph/tls-termination-websocket-upgrade-mismatch

Pattern

TLS-Termination Breaks WebSockets

tls-termination-websocket-upgrade-mismatch

WebSocket connections fail over wss on port 443 because TLS termination/proxying (e.g., tailscale serve ACME path or mismatched listener routes) rejects or drops Upgrade/hop-by-hop semantics, causing ERR_SSL_PROTOCOL_ERROR and immediate close instead of a successful handshake.

Node Details

Public graph metadata

Updated5/30/2026

Connections

30 linked nodes

This particular set of mysterious errors has been asked about on Sentry's GitHub — they reference a WebKit issue. Tension: they are caused by an error coming from a Safari browser extension. Outcome: can safely be ignored, or filtered.

I have a problem with Websocket authentication using Laravel's broadcasting with Pusher. — From time to time it returns 403 when JTW token is refreshed. Tension: How can I log all 4xx and 5xx requests to Sentry?

FastAPI websocket closes immediately after accept() and send_text()

When I send an HTTPS request using the Swagger UI. Tension: the redirection then fails. Outcome: I found a solution by referring to this GitHub issue: https://github.com/encode/uvicorn/issues/369.

The problem is that now the connection ends in a timeout error. Tension: azure refuses the connection attempt due to the ssl dependency.

intermittently logged `[REDACTED]` after fresh browser loads and route changes — A custom activity/chat overlay. Tension: The page checked the gateway browser client for an open WebSocket and then immediately sent RPCs such as session subscribe/list/history. Outcome: The client flag represented the raw socket state, not completion of the gateway's first-frame `connect` handshake.

HTTPClientError: An HTTP Client raised an unhandled exception: sequence item 0: expected str instance, bytes found — save it into a S3 bucket. Tension: My issue is I have added a python `requests` layer which somehow messed with how Lambda send the object to s3 using https. Outcome: The error is gone if I remove the layer.

updating the connection of an s3 bucket, from TLS 1.0 to TLS1.2 — the following connection has been detected: `eu-west-3|bucket| REST.GET.OBJECT|TLSv1|62|[BPImageWalker/2.0 (www.bdbrandprotect.com)]`. Tension: I have been unable to detect where it comes from. Outcome: cloudtrail to detect TLS 1.0 connections and the results are 0.

EventSource streaming responses work locally and in normal deployment but fail when routed through Cloudflare. The client does not receive a working text/event-stream stream.

WebSocket connection to 'wss://xxx:3500/' failed: — when connecting via WebSocket in React. Tension: but when connecting via Websocket in React, it throws always this error.

SIGSEGV in client handshake retry after no_renegotiation warning alert mid-ServerHello — CVE-2020-24659 in GnuTLS <= 3.6.14. Outcome: Fixed in 3.6.15 by commit 29ee67c2.

Recently they changed the security protocol to TLSV1.2 and so I can no longer access it. Tension: I need to access a web service using C# and so far everything has worked well. Outcome: System.Net.WebException: The underlying connection was closed: Unexpected error on a send.

this dependency has 2 critical vulnurabilities — org.eclipse.jetty jetty-websocket 8.1.1.v20120215. Tension: there are no correspondng version of `jetty-websocket` so I have no idea how can I fix this issue. Outcome: Those vulnerabilities are fixed in jetty-server » 9.3.24.v20180605.

I get error, `undefined reference to TLS_server_method`. — That was in an Alpine Linux container. But on Arch Linux it worked. Tension: apparently in Alpine Linux they chose to pass `--as-needed` to the linker. Outcome: Dynamic libraries are supposed to follow files that reference them if `--as-needed` is passed.

Weaviate running in Docker over HTTP could not be accessed via HTTPS; curl to https://localhost:8080/v1/schema failed with an SSL_ERROR_SYSCALL during the TLS handshake.

Failed authentication with /127.0.0.1 (SSL handshake failed) — when I try to setup SSL in my localhost kafka. Tension: Verify return code: 19 (self signed certificate in certificate chain). Outcome: I guess the problem come from me and not the script/tutorial.

close: Bad file descriptor (9) — proxychains google-chrome-beta dnsleaktest.com. Tension: the core gets dumped due to "Bad file descriptor". Outcome: Trace/breakpoint trap (core dumpe.

Browsers started logging a Content Security Policy (CSP) violation indicating that requests to https://vortex.data.microsoft.com/collect/v1 were refused because the page’s connect-src directive does not allow that endpoint.

I want to accept that fact that proxy is using insecure TLS certificates but I still want to establish secure TLS session to my destination. Tension: I can only disable TLS verification to both proxy and destination with `InsecureSkipVerify`.

this is what my WebSocketConfig.java looks like — registry.addEndpoint("/ws").withSockJS();. Tension: the CORS configuration is missing in the WebSocketConfig. Outcome: Try adding the following and attempt again.

WebSocket connection fails in the browser when using the Docker service name as the host

we are seeing 500 errors when hitting some backend endpoints — we have a react-based (version 16.14.0) PWA that is hosted on Microsoft Azure app service plans (premium tier). Tension: It is ONLY affects POST endpoints. GET endpoints successfully continue to work to these backends. Outcome: Current workaround is to change your app service to use http 1.1.

A Spring Boot WebSocket client fails to establish a connection to Binance when the WebSocket URL becomes long (e.g., ~300 symbols), while shorter URLs (~200 symbols) work. There are no clear logs or error messages, and Postman succeeds with the same long URL.

the first request is always failing since the http-proxy doesn't recognize it as a websocket request. Tension: I struggled to decrypt the accessToken in time and add it to the request before it's sent. Outcome: for now it's not bothering me that much.

WebSocket connections to `wss://<host>:443` fail when proxied via `tailscale serve` (e.g., port 443 → localhost backend), producing `ERR_SSL_PROTOCOL_ERROR`/TLS internal error and closing immediately. The same backend and proxy config works correctly when served on a custom port (e.g., 8443).

a timing side-channel vulnerability exists in _gnutls_srtp_recv_params() — When parsing DTLS ClientHello SRTP extension profiles. Tension: the server uses a non-constant-time nested loop. Outcome: An attacker sends DTLS ClientHellos with varying SRTP profile orderings, measures response timing, and reconstructs the server's profile preference order.

heap buffer overflow vulnerability in curl's SOCKS5 proxy handshake when processing hostnames — when processing hostnames. Tension: the hostname length is truncated to a single byte via an unsafe cast, but the full hostname is still copied into the buffer. Outcome: causing heap memory corruption.

GnuTLS 3.6.14 crashes with a NULL pointer dereference — when processing a crafted TLS ClientHello with a session_ticket extension during session resumption. Tension: An attacker can trigger this by sending a malformed ClientHello during session resumption, causing server denial of service. Outcome: The vulnerability exists in GnuTLS 3.6.14 and is triggered during TLS session resumption when a ClientHello contains a malformed session_ticket extension with NULL or empty data.

WebSocket connections to external services use Sandbox.WebSocket, not System.Net.WebSockets (sandboxed out) — In s&box. Tension: Developers need WebSockets for real-time external data (chat, live scores, IoT). The same URL restrictions as Http apply — no IP addresses, HTTPS/WSS only.

Dev hot-reload silently stops working — Next.js (App Router) and a WebSocket server in the same Node process. Outcome: In production it doesn't matter because there's no HMR, but the dev experience is broken.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata