diff --git a/cheroot/test/test_ssl.py b/cheroot/test/test_ssl.py
index 1859e6bc28..0a04d2bed6 100644
--- a/cheroot/test/test_ssl.py
+++ b/cheroot/test/test_ssl.py
@@ -527,7 +527,9 @@ def test_tls_client_auth(  # noqa: C901, WPS213  # FIXME
                 "'Remote end closed connection without response'))",
             )
 
-        assert any(e in err_text for e in expected_substrings)
+        assert any(e in err_text for e in expected_substrings), (
+            f'Unexpected error text: {err_text!r}'
+        )
 
 
 @pytest.mark.parametrize(  # noqa: C901  # FIXME
@@ -697,14 +699,26 @@ def test_https_over_http_error(http_server, ip_addr):
         http.client.HTTPSConnection(
             f'{interface}:{port}',
         ).request('GET', '/')
-    expected_substring = (
-        'record layer failure'
-        if IS_ABOVE_OPENSSL31
-        else 'wrong version number'
-        if IS_ABOVE_OPENSSL10
-        else 'unknown protocol'
-    )
-    assert expected_substring in ssl_err.value.args[-1]
+    underlying_error_string = str(ssl_err.value)
+    if IS_ABOVE_OPENSSL31 and IS_WINDOWS:
+        # On Windows, the TCP reset (RST) is surfaced before OpenSSL processes
+        # the server's response, yielding 'wrong version number' rather than
+        # the usual 'record layer failure'. See CPython's own test_ssl.py:
+        # https://github.com/python/cpython/blob/\
+        # 1b9fe5c7226eccc8b269a7443148033080399f43\
+        # /Lib/test/test_ssl.py#L5705
+        assert 'wrong version number' in underlying_error_string
+    elif IS_ABOVE_OPENSSL31:
+        # Newer Python returns 'record layer failure'; Python 3.8 on macOS
+        # returns 'wrong version number' despite OpenSSL >= 3.1.
+        assert (
+            'record layer failure' in underlying_error_string
+            or 'wrong version number' in underlying_error_string
+        )
+    elif IS_ABOVE_OPENSSL10:
+        assert 'wrong version number' in underlying_error_string
+    else:  # pragma: no cover
+        assert 'unknown protocol' in underlying_error_string
 
 
 def test_http_over_https_no_data(mocker):
diff --git a/docs/changelog-fragments.d/828.contrib.rst b/docs/changelog-fragments.d/828.contrib.rst
new file mode 100644
index 0000000000..831d85ab91
--- /dev/null
+++ b/docs/changelog-fragments.d/828.contrib.rst
@@ -0,0 +1,3 @@
+Fixed ``test_https_over_http_error`` failing on Windows with OpenSSL 3.1+,
+where the SSL error message is ``wrong version number`` rather than
+``record layer failure`` -- by :user:`julianz-`.