# "Bad HTTP parsed" warning message

**URL:** <https://forum.inductiveautomation.com/t/bad-http-parsed-warning-message/51417>\
**Category:** Ignition\
**Tags:** ignition79\
**Created:** [September 28, 2021, 7:39pm UTC](https://forum.inductiveautomation.com/t/bad-http-parsed-warning-message/51417 "2021-09-28T19:39:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Troy](https://avatars.discourse-cdn.com/v4/letter/t/85f322/32.png) [@Troy](https://forum.inductiveautomation.com/u/Troy)\
**Post date:** [September 28, 2021, 7:39pm UTC](https://forum.inductiveautomation.com/t/bad-http-parsed-warning-message/51417/1 "2021-09-28T19:39:12Z")

</div>

(version 7.9.3)  
Based on what I read, this is caused by the gateway trying to parse HTTPS as HTTP.  
As far as I can tell, we are not using HTTPS on the gateway at all. I checked the config settings and "Use SSL" is unchecked.  
How can I find what is making these requests and get it to use HTTP? They are showing up the logs every few seconds and it makes it hard to debug other issues.

It seems like everything in the project is working as it should, the project has been like this since I took it over.

I saw a post that cleared a cache to fix it, but they were getting an EOFException and I am not. I can try clearing the cache but I'm not sure how.

> [@Unable to Launch Linux Client - EOFException: null](https://forum.inductiveautomation.com/t/unable-to-launch-linux-client-eofexception-null/21351):
>
> I’m having a strange issue. We’re attempting to do our first installation of Ignition with Linux software. The server is running without an issue, and we’re able to launch the client remotely from Windows machines, but anytime we try to run the client from a Linux machine, even directly on the server, it fails to load. In the logs, we get HttpParser errors saying the following (I’m trying to get log files attached, need to find a way to make the file smaller or host it somewhere): bad HTTP pars…

In this next post, they changed the port to 8088 (which we are already using) and said to disable "Use SSL" and "Require SSL". I cannot seem to find "Require SSL" on the gateway settings or on this page of [the 7.9 doc](https://docs.inductiveautomation.com/display/DOC79/Gateway+Security). We are also only using 1 gateway.

> [@Gateway Network - 400 Illegal character CNTL=0x15](https://forum.inductiveautomation.com/t/gateway-network-400-illegal-character-cntl-0x15/38525):
>
> Hi there, I’m trying to set up a Gateway Network connection between two Ignition servers. I configured an outgoing connection on Gateway1 but I am receiving the following error in the log. I don’t see any incoming connections on Gateway2. org.eclipse.jetty.websocket.api.UpgradeException: 400 Illegal character CNTL=0x15 Caused by: org.eclipse.jetty.client.HttpResponseException: HTTP protocol violation: bad response on HttpConnectionOverHTTP@180ffe40::SocketChannelEndPoint@5b424b3d{/10.110.34.88…

A few errors from the logs:  
`Illegal character 0x16 in state=START for buffer HeapByteBuffer@1eac3215[p=1,l=198,c=8192,r=197]={\x16<<<\x03\x03\x00\xC1\x01\x00\x00\xBd\x03\x03aS<\xEd\xB9\x01:...\x03\x04\x01\x04\x02\x02\x03\x02\x01\x02\x02\x00\x17\x00\x00>>>ntent-Length: 639...0EeJl8aj+Tu+QoE}`

`Illegal character 0x16 in state=START for buffer HeapByteBuffer@6d4bb024[p=1,l=198,c=8192,r=197]={\x16<<<\x03\x03\x00\xC1\x01\x00\x00\xBd\x03\x03aSXi\x06\x88\x8d...\x03\x04\x01\x04\x02\x02\x03\x02\x01\x02\x02\x00\x17\x00\x00>>>rg name="dsn">`

`bad HTTP parsed: 400 Illegal character 0x16 for HttpChannelOverHttp@1f916da2{r=0,c=false,a=IDLE,uri=null}`

Thanks!

---

<div class="post-metadata">

**Author:** ![keenern](https://avatars.discourse-cdn.com/v4/letter/k/779978/32.png) [@keenern](https://forum.inductiveautomation.com/u/keenern)\
**Post date:** [June 8, 2023, 11:30am UTC](https://forum.inductiveautomation.com/t/bad-http-parsed-warning-message/51417/2 "2023-06-08T11:30:29Z")

</div>

I see no one ever responded to this post. I am now having the same issue and was wondering if you found a solution?

---

<div class="post-metadata">

**Author:** ![Troy](https://avatars.discourse-cdn.com/v4/letter/t/85f322/32.png) [@Troy](https://forum.inductiveautomation.com/u/Troy)\
**Post date:** [June 8, 2023, 7:39pm UTC](https://forum.inductiveautomation.com/t/bad-http-parsed-warning-message/51417/3 "2023-06-08T19:39:56Z")

</div>

I might have used Wireshark to try to locate what was sending HTTPS data to my Ignition server.. It was a while ago so I don't remember.

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [June 8, 2023, 9:20pm UTC](https://forum.inductiveautomation.com/t/bad-http-parsed-warning-message/51417/4 "2023-06-08T21:20:46Z")

</div>

From my experience, this usually comes from random network scanning appliances installed by IT departments. They blindly look for open ports, spam a long list of vulnerability payloads, and report back to their overlords if they find anything vulnerable.

None of them have ever found anything useful in Ignition, to my knowledge, but the side effect of them running is usually one or more of the garbage payloads they deliver to the webserver triggers (legitimate) errors in the logs.
