{"record":{"id":"0378ce4dc22cab4c","repo":"golang/go","slug":"tls-unexpected-encrypted-client-hello-extension-i-0378ce","errorCode":null,"errorMessage":"tls: unexpected encrypted client hello extension in serverHello","messagePattern":"tls: unexpected encrypted client hello extension in serverHello","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/handshake_client_tls13.go","lineNumber":289,"sourceCode":"\t\t\t\tc.sendAlert(alertInternalError)\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tacceptConfirmation := tls13.ExpandLabel(h, prk, \"hrr ech accept confirmation\", confTranscript.Sum(nil), 8)\n\t\t\tif subtle.ConstantTimeCompare(acceptConfirmation, hs.serverHello.encryptedClientHello) == 1 {\n\t\t\t\thello = hs.echContext.innerHello\n\t\t\t\tc.serverName = c.config.ServerName\n\t\t\t\tisInnerHello = true\n\t\t\t\tc.echAccepted = true\n\t\t\t}\n\t\t}\n\n\t\tif err := transcriptMsg(hs.serverHello, hs.echContext.innerTranscript); err != nil {\n\t\t\treturn err\n\t\t}\n\t} else if hs.serverHello.encryptedClientHello != nil {\n\t\t// Unsolicited ECH extension should be rejected\n\t\tc.sendAlert(alertUnsupportedExtension)\n\t\treturn errors.New(\"tls: unexpected encrypted client hello extension in serverHello\")\n\t}\n\n\t// The only HelloRetryRequest extensions we support are key_share and\n\t// cookie, and clients must abort the handshake if the HRR would not result\n\t// in any change in the ClientHello.\n\tif hs.serverHello.selectedGroup == 0 && hs.serverHello.cookie == nil {\n\t\tc.sendAlert(alertIllegalParameter)\n\t\treturn errors.New(\"tls: server sent an unnecessary HelloRetryRequest message\")\n\t}\n\n\tif hs.serverHello.cookie != nil {\n\t\thello.cookie = hs.serverHello.cookie\n\t}\n\n\tif hs.serverHello.serverShare.group != 0 {\n\t\tc.sendAlert(alertDecodeError)\n\t\treturn errors.New(\"tls: received malformed key_share extension\")\n\t}","sourceCodeStart":271,"sourceCodeEnd":307,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/handshake_client_tls13.go#L271-L307","documentation":"Thrown during HelloRetryRequest processing when the server includes an encrypted_client_hello extension in the ServerHello but the client has no ECH context (hs.echContext is nil). This means the client did not send ECH, so the server's ECH extension is unsolicited.","triggerScenarios":"Triggered in the else-if branch when hs.echContext is nil and hs.serverHello.encryptedClientHello is not nil. The client sends alertUnsupportedExtension.","commonSituations":"Server sending an ECH extension without the client having requested it. Client config does not set EncryptedClientHelloConfigList but the server responds with ECH. Server bug or misconfiguration sending unsolicited ECH extension.","solutions":["If you want ECH support, set config.EncryptedClientHelloConfigList with valid ECH configuration records from DNS HTTPS/SVCB records.","If you do not need ECH, this is a server bug — the server should not send an unsolicited encrypted_client_hello extension.","Report the issue to the server operator with details of the unexpected extension.","Test with ECH disabled on a known-good server to rule out client-side issues."],"exampleFix":"// before — no ECH config but server expects it\nconfig := &tls.Config{\n    ServerName: \"example.com\",\n}\n\n// after — provide ECH config list from DNS HTTPS records\nconfig := &tls.Config{\n    ServerName:                      \"example.com\",\n    EncryptedClientHelloConfigList: echConfigList, // from DNS HTTPS RR\n}","handlingStrategy":"validation","validationCode":"// Validate ECH context before connecting\nfunc validateECHPresence(config *tls.Config) error {\n    // If the server is known to expect ECH, ensure the config list is set\n    if config.EncryptedClientHelloConfigList == nil {\n        // Not an error per se, but warn if connecting to an ECH-capable server\n        log.Println(\"warning: no ECH config list set; servers expecting ECH will fail\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"conn, err := tls.Dial(\"tcp\", addr, config)\nif err != nil {\n    if strings.Contains(err.Error(), \"unexpected encrypted client hello extension in serverHello\") {\n        // Server sent unsolicited ECH — this is a server bug, nothing the client can fix\n        log.Printf(\"server sent unsolicited ECH extension: %v\", err)\n    }\n}","preventionTips":["Fetch ECHConfigList from DNS HTTPS/SVCB records before connecting to ECH-capable servers.","Report servers sending unsolicited ECH extensions to the operator.","Test with ECH disabled to confirm the error source."],"tags":["tls","go","ech","tls13","unsolicited-extension","protocol-violation"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}