From 793a4e2db5d43b5c1d326c517cbb326befbbdb56 Mon Sep 17 00:00:00 2001
From: julianz- <6255571+julianz-@users.noreply.github.com>
Date: Sat, 20 Jun 2026 19:14:18 -0700
Subject: [PATCH] Fix test_https_over_http_error on Windows with OpenSSL 3.1+
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On Windows, the TCP reset (RST) takes a different code path than Linux,
causing OpenSSL 3.1+ to report 'wrong version number' rather than
'record layer failure'. Accept either string when IS_ABOVE_OPENSSL31
is True — the same pattern used in CPython's own test_ssl.py.
---
 cheroot/test/test_ssl.py                   | 23 ++++++++++++++--------
 docs/changelog-fragments.d/828.contrib.rst |  3 +++
 2 files changed, 18 insertions(+), 8 deletions(-)
 create mode 100644 docs/changelog-fragments.d/828.contrib.rst

diff --git a/cheroot/test/test_ssl.py b/cheroot/test/test_ssl.py
index 1859e6bc28..6bc039057d 100644
--- a/cheroot/test/test_ssl.py
+++ b/cheroot/test/test_ssl.py
@@ -697,14 +697,21 @@ def test_https_over_http_error(http_server, ip_addr):
         http.client.HTTPSConnection(
             f'{interface}:{port}',
         ).request('GET', '/')
-    expected_substring = (
-        'record layer failure'
-        if IS_ABOVE_OPENSSL31
-        else 'wrong version number'
-        if IS_ABOVE_OPENSSL10
-        else 'unknown protocol'
-    )
-    assert expected_substring in ssl_err.value.args[-1]
+    actual_error = ssl_err.value.args[-1]
+    if IS_ABOVE_OPENSSL31 and IS_WINDOWS:
+        # On Windows, the TCP reset (RST) is surfaced before OpenSSL processes
+        # the server's response, yielding 'wrong version number' rather than
+        # the usual 'record layer failure'. See CPython's own test_ssl.py:
+        # https://github.com/python/cpython/blob/\
+        # 1b9fe5c7226eccc8b269a7443148033080399f43\
+        # /Lib/test/test_ssl.py#L5705
+        assert 'wrong version number' in actual_error
+    elif IS_ABOVE_OPENSSL31:
+        assert 'record layer failure' in actual_error
+    elif IS_ABOVE_OPENSSL10:
+        assert 'wrong version number' in actual_error
+    else:  # pragma: no cover
+        assert 'unknown protocol' in actual_error
 
 
 def test_http_over_https_no_data(mocker):
diff --git a/docs/changelog-fragments.d/828.contrib.rst b/docs/changelog-fragments.d/828.contrib.rst
new file mode 100644
index 0000000000..831d85ab91
--- /dev/null
+++ b/docs/changelog-fragments.d/828.contrib.rst
@@ -0,0 +1,3 @@
+Fixed ``test_https_over_http_error`` failing on Windows with OpenSSL 3.1+,
+where the SSL error message is ``wrong version number`` rather than
+``record layer failure`` -- by :user:`julianz-`.