Problem Statement

In the Redpanda log,  sometimes you see Kafka's SSL handshake error SSL routines::wrong version number.  Here are the example logs;

WARN 2025-01-03 00:19:32,569 [shard 0:main] kafka - server.cc:402 - Error kafka rpc protocol 10.244.1.11:57428: std::__1::system_error (error OpenSSL:167772427, Failed to establish SSL handshake: [error:0A00010B:SSL routines::wrong version number]: error:0A00010B:SSL routines::wrong version number) (sasl state: initial)
ERROR 2025-01-03 00:19:32,569 [shard 0:main] kafka - server.cc:159 - Error[applying protocol] remote address: 10.244.1.11:57428 - std::__1::system_error (error OpenSSL:167772427, Failed to establish SSL handshake: [error:0A00010B:SSL routines::wrong version number]: error:0A00010B:SSL routines::wrong version number)

How can I fix and get rid of this error message? 

Solution

This error message indicates that a Kafka client with a non-TLS session was connected to the TLS-enabled Redpanda broker.  To fix this issue, you can find the Kafka client in the error message from the source IP address. You need to set the proper TLS configuration on the Kafka client. 
In case the rpk command was used, you may need to add -X tls.enabled=true (Ref: link )

Notes

The client-side error message related to this SSL error message may depend on the client application. For example, the rpk command with -v option may show the following messages.

connection initialization failed {"addr": "redpanda-0.redpanda.redpanda-system.svc.cluster.local.:9093", "broker": "seed_0", "err": "EOF"}
unable to request metadata: EOF