From f5bb64314278e19d3ac6eabe5f88b03c28f0cf15 Mon Sep 17 00:00:00 2001
From: julianz- <6255571+julianz-@users.noreply.github.com>
Date: Sat, 20 Jun 2026 19:14:18 -0700
Subject: [PATCH] Fix test_https_over_http_error on Windows with OpenSSL 3.1+
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On Windows, the TCP reset (RST) takes a different code path than Linux,
causing OpenSSL 3.1+ to report 'wrong version number' rather than
'record layer failure'. Accept either string when IS_ABOVE_OPENSSL31
is True — the same pattern used in CPython's own test_ssl.py.
---
 cheroot/test/test_ssl.py                  | 24 +++++++++++++++--------
 docs/changelog-fragments.d/828.bugfix.rst |  3 +++
 2 files changed, 19 insertions(+), 8 deletions(-)
 create mode 100644 docs/changelog-fragments.d/828.bugfix.rst

diff --git a/cheroot/test/test_ssl.py b/cheroot/test/test_ssl.py
index 1859e6bc28..f871683e4b 100644
--- a/cheroot/test/test_ssl.py
+++ b/cheroot/test/test_ssl.py
@@ -697,14 +697,22 @@ def test_https_over_http_error(http_server, ip_addr):
         http.client.HTTPSConnection(
             f'{interface}:{port}',
         ).request('GET', '/')
-    expected_substring = (
-        'record layer failure'
-        if IS_ABOVE_OPENSSL31
-        else 'wrong version number'
-        if IS_ABOVE_OPENSSL10
-        else 'unknown protocol'
-    )
-    assert expected_substring in ssl_err.value.args[-1]
+    actual_error = ssl_err.value.args[-1]
+    if IS_ABOVE_OPENSSL31:
+        # OpenSSL 3.1+ usually reports 'record layer failure', but some builds
+        # report 'wrong version number' instead (e.g. Python 3.14.6 on Windows
+        # where the TCP reset takes a different code path). See CPython:
+        # https://github.com/python/cpython/blob/\
+        # 1b9fe5c7226eccc8b269a7443148033080399f43\
+        # /Lib/test/test_ssl.py#L5705
+        assert (
+            'record layer failure' in actual_error
+            or 'wrong version number' in actual_error
+        ), actual_error
+    elif IS_ABOVE_OPENSSL10:
+        assert 'wrong version number' in actual_error
+    else:  # pragma: no cover
+        assert 'unknown protocol' in actual_error
 
 
 def test_http_over_https_no_data(mocker):
diff --git a/docs/changelog-fragments.d/828.bugfix.rst b/docs/changelog-fragments.d/828.bugfix.rst
new file mode 100644
index 0000000000..831d85ab91
--- /dev/null
+++ b/docs/changelog-fragments.d/828.bugfix.rst
@@ -0,0 +1,3 @@
+Fixed ``test_https_over_http_error`` failing on Windows with OpenSSL 3.1+,
+where the SSL error message is ``wrong version number`` rather than
+``record layer failure`` -- by :user:`julianz-`.