Java SpringBoot Webflux: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record:

Question

Small question regarding Spring Webflux and Java, reproducible among any 2.x+ versions.

I see often in my logs, exceptions like:

Failed to select the application-level protocol:
io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: 1201003400000000000015000601001b000102001c000c0300280004ff080001550000004d5353514c3365727665720078080000
    at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1216) ~[netty-handler-4.1.66.Final.jar!/:4.1.66.Final]

TLS handshake failed:
io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: 006a0000010000000136012c000008007fff7f08000000010020003a0000000000000000000000000000000034e600000001000000000000000028434f4e4e4543545f444154413d28434f4d4d414e443d56455253494f4e2929
    at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1216) ~[netty-handler-4.1.66.Final.jar!/:4.1.66.Final]

I was wondering, what is the meaning of the part after "not an SSL/TLS record" please? The long piece of gibberish "12010034000000[...] 006a0000010000[...]"

Thank you

It's hexadecimal. 4d5353514c336572766572 is the (ASCII) characters 'MSSQL3erver' which is almost certainly an MSSQL client, and 28434f4e4e4543545f444154413d28434f4d4d414e443d56455253494f4e2929 is '(CONNECT_DATA=(COMMAND=VERSION))' which looks to me like an Oracle client. — dave_thompson_085
– dave_thompson_085, Commented Jan 11, 2022 at 4:26
@dave_thompson_085 I am getting same error with a different message. Can you give me a reason behind this error. — Kavindu Ravishka
– Kavindu Ravishka, Commented Jun 19, 2022 at 21:50
@KavinduRavishka: something is trying to connect to your SSL/TLS port using a protocol other than SSL/TLS. In the examples given it was (probably) database clients misconfigured to talk to the wrong host/port. With different data it's probably something else. — dave_thompson_085
– dave_thompson_085, Commented Jun 20, 2022 at 6:49

PatPanda · Accepted Answer · 2022-03-04 02:17:48Z

2

As dave_thompson_085 mentioned, verified it is the hexadecimal string representation of the client.

All credits to him (I wish I could just accept his comment as answer).

This was particularly helpful as we could identify some clients performing some attacks. Thanks a lot

answered Mar 4, 2022 at 2:17

PatPanda

5,41832 gold badges142 silver badges281 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Java SpringBoot Webflux: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record:

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related