SSL WRONG_VERSION_NUMBER via a proxy: the fix

What does SSL: WRONG_VERSION_NUMBER mean?

TLS starts with a handshake record. If the bytes that come back are an HTTP response instead, the TLS library reads a nonsense version number and stops. Python reports WRONG_VERSION_NUMBER; the exact wording varies with the OpenSSL version and the client.

The proxy URL scheme decides how your client talks to the proxy. http:// means plain HTTP to the proxy, followed by a CONNECT tunnel and TLS with the website. https:// means TLS with the proxy itself, which only works if the proxy port expects TLS.

What does SSL: WRONG_VERSION_NUMBER look like in Python, curl, Node.js and browsers?

The same failure prints differently in every tool. These are the messages to search your logs for:

• Python requests / urllib3 2.x: SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number')) wrapped in a ProxyError
• httpx: httpx.ConnectError: [SSL: WRONG_VERSION_NUMBER] wrong version number
• curl: curl: (35) ... wrong version number when you write -x https:// for a plain proxy
• Node.js: EPROTO ... wrong version number in the error message

What causes SSL: WRONG_VERSION_NUMBER?

Most likely first:

• https:// in front of the proxy address on a port that speaks plain HTTP. This is the most common case.
• Copy-pasted settings from a provider whose proxy port does expect TLS.
• https:// on a URL with port 80, or http:// on a site port that expects TLS, outside any proxy.
• An environment variable such as HTTPS_PROXY=https://... that your code inherits.

How do I diagnose SSL: WRONG_VERSION_NUMBER step by step?

1. Print the proxy URL your code uses and check its scheme.
2. Check the environment for HTTPS_PROXY and ALL_PROXY.
3. Run the curl test below with -x http:// and confirm it works.
4. If curl works and your code does not, your code or environment still uses https://.

# Use the URL that fails; with https://api.ipify.org instead, you test the gateway alone.
# "HTTP/1.1 200 Connection established" first, then the site's own status: the site answered.
curl -v -x http://USERNAME:[email protected]:7777 https://TARGET_URL

# Same test through the SOCKS5 port, with DNS resolved at the exit
curl -v --socks5-hostname gw.crawlrelay.com:7778 --proxy-user USERNAME:PASSWORD https://TARGET_URL

How do I fix SSL: WRONG_VERSION_NUMBER?

• Use http:// for the proxy URL in every key: {"http": "http://...", "https": "http://..."}.
• Leave TLS verification on. The fix is the scheme, not verify=False.
• Fix the environment variable instead of overriding it in one script.

Should I retry after SSL: WRONG_VERSION_NUMBER?

Never retry this error: every attempt fails the same way. It is a one-character configuration fix.

How does SSL: WRONG_VERSION_NUMBER apply to CrawlRelay?

CrawlRelay's HTTP port is a plain HTTP proxy port that carries HTTPS sites through CONNECT tunnels. TLS runs end to end between your client and the website inside the tunnel, so the gateway never needs an https:// proxy URL.

Gateway: gw.crawlrelay.com, port 7777 (HTTP, HTTPS through CONNECT) and port 7778 (SOCKS5). Username format: USERNAME-country-{cc}-state-{state}-city-{city}-zip-{zip}-asn-{asn}-session-{id}-ttl-{minutes}. Related: SSL certificate verify failed · Cannot connect to proxy · Python guide.