cloudflared: ERR failed to connect to origin error="websocket: bad handshake"

I had the same problem:

2021-11-09T12:02:09Z ERR failed to connect to origin error=“websocket: bad handshake” originURL=

For me this happened after I set the ‘Definitely automated’ of ‘Configure Super Bot Fight Mode’ to Challenge (this is under Firewall/Bots on the Cloudflare dashboard). Changing the setting back to Allow resolved the issue.

As the description of this setting is ‘Definitely automated traffic typically consists of bad bots. Select an action for this traffic.’, I was surprised that it impacted Tunnels.

I too had this problem, and the solution was to turn off the “Enable Binding Cookie” in the Application settings in Teams. So much wasted time, please add this to the documentation. Credit for the solution goes here: (https://community.cloudflare.com/t/ssh-over-cloudflare-tunnel-always-results-in-failed-to-connect-to-origin-error-websocket-bad-handshake-unless-i-use-the-web-terminal/280924/4)

Finally, found an issue… this definitely has to be added to documentation of Argo Tunnel/CF Access/CF for Teams - impact of SSL/TLS settings when Universal SSL is enabled/disabled.

On my test account Universal SSL was enabled, but SSL/TLS encryption mode was OFF. If Universal SSL is enabled, SSL/TLS encryption mode must be Flexible/Full/Full(strict) - it solves ““websocket: bad handshake”” issue for me.

@nmldiegues thanks for assistance.

I ran into the “remote error: tls: handshake failure” using the “a.b.domain.tld” pattern and it ended up being a bad certificate. Cloudflare gives you a free edge cert for “*.domain.tld” but that doesn’t cover multi-level subdomains. After adding an Advanced Certificate for “*.b.domain.tld” it worked perfectly!

Maybe the DNS dashboard could show a warning for any records with proxy enabled that don’t have a valid edge cert? I’ve had other unrelated issues caused by the same thing in the past and it’s always very hard to debug.

Finally, found [the?] issue… this definitely has to be added to documentation of Argo Tunnel/CF Access/CF for Teams - impact of SSL/TLS settings when Universal SSL is enabled/disabled.

On my test account Universal SSL was enabled, but SSL/TLS encryption mode was OFF. If Universal SSL is enabled, SSL/TLS encryption mode must be Flexible/Full/Full(strict) - it solves ““websocket: bad handshake”” issue for me.

@nmldiegues thanks for assistance.

Unfortunately, not. I’m having Strict SSL (and tried others as well), running the same version of cloudflared on both client and the server and facing this issue… Let me know how I can I help to troubleshoot/isolate the issue. Thanks! Running a single tunnel, multiple ingress rules, with other rules working at the time when SSH from a native-client is failing.

Edit: My SSH domain is like: sub.domain.cc.cc.ext. Wondering if this could cause issues with cloudflared or with the service, with the below error:

I was able to resolve the web sockets error but enabling web sockets under the Network section. Sigh.

2021-05-23T19:17:00Z ERR failed to connect to origin error="remote error: tls: handshake failure" originURL=https://a.b.c.d
remote error: tls: handshake failure
kex_exchange_identification: Connection closed by remote host

Got similar problems and errors here. I found that if you have too many levels on your subdomain then SSH rules doesn’t work correctly in cloudflared. Above you see errors when I had sub domain a.b.c.d which doesn’t work, but if I change it to b.c.d it starts working.

On my Windows client, I had to remove the host from known_hosts to get it working again.