Troubleshoot Secure Access Error "TLS Error: 268435703:SSL routines:OPENSSL_internal:WRONG_VERSION_NUMBER"

Introduction

This document describes a way to resolve the Secure Access error: "TLS error: 268435703:SSL routines:OPENSSL_internal:WRONG_VERSION_NUMBER".

Problem 

When a user tries to open a Private Resource using Browser-Based Zero Trust Access, using the public URL for the resource (for example https://<app-name>.ztna.sse.cisco.io), the application does not load in the browser and the error is seen:

Application is unreachable

Please contact your administrator

upstream connect error or disconnect/reset before headers. reset reason: connection failure, transport failure reason: TLS error: 268435703:SSL routines:OPENSSL_internal:WRONG_VERSION_NUMBER

Secure Client Error

Solution

Make sure you configure a proper Protocol under the Endpoint Connection Method in the Private Resource Section:

• If the private application is available over HTTP only, you must select HTTP.
• If the private application is available over HTTPs only, you must select HTTPs.
• If the private application is available over HTTP or HTTPs, this error must never be seen.

Private Resource Configuration

Additional Details 

The Secure Access proxy engine tries to establish a connection to the Private Resource using the Protocol specified in the dashboard.
If the proxy is unable to establish HTTPs channel with the private application (due to misconfiguration on either side), you can see OpenSSL-related errors in the browser when trying to access Private Resources via the Browser-based connection.

Related Information

• Secure Access User Guide
• Technical Support & Documentation - Cisco Systems