SSL connect error (35) TLS connect error: error:0A000126:SSL routines::unexpected eof while reading

[sharpchen]

Errors

Such error started to appear after I set proxy for my nixos-wsl.

error on build

warning: error: unable to download 'https://nix-community.cachix.org/nix-cache-info': SSL connect error (35) Recv failure: Connection reset by peer; retrying in 307 ms
warning: error: unable to download 'https://nix-community.cachix.org/nix-cache-info': SSL connect error (35) Recv failure: Connection reset by peer; retrying in 510 ms
warning: error: unable to download 'https://nix-community.cachix.org/nix-cache-info': SSL connect error (35) Recv failure: Connection reset by peer; retrying in 1135 ms
warning: error: unable to download 'https://nix-community.cachix.org/nix-cache-info': SSL connect error (35) Recv failure: Connection reset by peer; retrying in 2142 ms

curl error

[sharpchen@nixos:~/.config/home-manager]$ curl https://nix-community.cachix.org/nix-cache-info -v
* Uses proxy env variable https_proxy == 'https://172.18.208.1:10809'
*   Trying 172.18.208.1:10809...
* ALPN: curl offers http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (OUT), TLS alert, decode error (562):
* TLS connect error: error:0A000126:SSL routines::unexpected eof while reading
* closing connection #0
curl: (35) TLS connect error: error:0A000126:SSL routines::unexpected eof while reading

wget works however

[sharpchen@nixos:~/.config/home-manager]$ wget https://nix-community.cachix.org/nix-cache-info -d --spider
Setting --spider (spider) to 1
DEBUG output created by Wget 1.25.0 on linux-gnu.

Reading HSTS entries from /home/sharpchen/.wget-hsts
URI encoding = ‘UTF-8’
URI encoding = ‘UTF-8’
Converted file name 'nix-cache-info' (UTF-8) -> 'nix-cache-info' (UTF-8)
Spider mode enabled. Check if remote file exists.
--2025-09-11 14:38:50--  https://nix-community.cachix.org/nix-cache-info
Connecting to 172.18.208.1:10809... connected.
Created socket 3.
Releasing 0x000000003365c6e0 (new refcount 0).
Deleting unused 0x000000003365c6e0.

---request begin---
CONNECT nix-community.cachix.org:443 HTTP/1.1
User-Agent: Wget/1.25.0
Host: nix-community.cachix.org:443

---request end---
proxy responded with: [HTTP/1.1 200 Connection established

]
Initiating SSL handshake.
Handshake successful; connected socket 3 to SSL handle 0x000000003366afb0
certificate:
  subject: CN=cachix.org
    issuer:  CN=WE1,O=Google Trust Services,C=US
    X509 certificate successfully verified and matches host nix-community.cachix.org

    ---request begin---
    HEAD /nix-cache-info HTTP/1.1
    Host: nix-community.cachix.org
    User-Agent: Wget/1.25.0
    Accept: */*
    Accept-Encoding: identity
    Connection: Keep-Alive
    Proxy-Connection: Keep-Alive

    ---request end---
    Proxy request sent, awaiting response...
    ---response begin---
    HTTP/1.1 200 OK
    Date: Thu, 11 Sep 2025 06:38:50 GMT
    Content-Type: application/octet-stream
    Connection: keep-alive
    Server: cloudflare
    Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
    traceparent: 00-33e6501515ac70324894919fc658cbff-4de7ba32f4fae050-01
    tracestate:
    last-modified: Thu, 11 Sep 2025 04:28:59 GMT
    Age: 845
    Cache-Control: max-age=14400
    cf-cache-status: HIT
    Vary: accept-encoding
    Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=eIzP5pJsq9MnXsBCHu1d4U%2FFnhh208I4YCEyHzh1khLZAJd%2FhlBvWzMviRbE6IzJcNekcJMJpIcQ29liPeMab3YSPbj%2F8X7p0y1lzkspZe%2BtGdTreicp"}]}
    CF-RAY: 97d52a1ecee7c613-SIN

    ---response end---
    200 OK
    Registered socket 3 for persistent reuse.
    Length: unspecified [application/octet-stream]
    Remote file exists.

What I have done:

1. use NAT mode for WSL(which is the default)
2. set proxy env variables like this:

if [[ $(uname --kernel-release) =~ 'WSL' ]]; then
    ip_bridge="$(ip route show | grep -i default | awk '{ print $3}')"
    export HTTP_PROXY="http://${ip_bridge}:10809"
    export HTTPS_PROXY="https://${ip_bridge}:10809"
    export http_proxy="http://${ip_bridge}:10809"
    export https_proxy="https://${ip_bridge}:10809"
fi

3. can confirm the proxy is working

Probably not a nix problem, but hopefully get some advice, thanks in advance!

[wintertee]

I just encountered the same issue after upgrading from Fedora 42 to Fedora 44 (WSL2 environment). I'm using a HTTP proxy connected to the Windows host (sing-box v1.12.14).

curl fails on TLS 1.2 but works fine on TLS 1.3:

# Fails with unexpected EOF
$ curl https://google.com --tlsv1.2
curl: (35) TLS connect error: error:0A000126:SSL routines::unexpected eof while reading

# Works fine
$ curl https://google.com --tlsv1.3

# Works when lowering security level
$ curl --tlsv1.2 --ciphers 'DEFAULT@SECLEVEL=1' https://google.com

The cause might be the proxy server cannot handle post-quantum cryptography standard with TLS 1.2. A workaround for me is:

sudo update-crypto-policies --set DEFAULT:NO-PQ

[wintertee]

I just opened an issue for this: SagerNet/sing-box#4141