{"record":{"id":"069a5b8ce2f9fc22","repo":"golang/go","slug":"tls-fips-140-3-requires-the-use-of-extended-maste-069a5b","errorCode":null,"errorMessage":"tls: FIPS 140-3 requires the use of Extended Master Secret","messagePattern":"tls: FIPS 140-3 requires the use of Extended Master Secret","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/handshake_server.go","lineNumber":744,"sourceCode":"\tif !ok {\n\t\tc.sendAlert(alertUnexpectedMessage)\n\t\treturn unexpectedMessageError(ckx, msg)\n\t}\n\n\tpreMasterSecret, err := keyAgreement.processClientKeyExchange(c.config, hs.cert, ckx, c.vers)\n\tif err != nil {\n\t\tc.sendAlert(alertIllegalParameter)\n\t\treturn err\n\t}\n\tif hs.hello.extendedMasterSecret {\n\t\tc.extMasterSecret = true\n\t\ths.masterSecret = extMasterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret,\n\t\t\ths.finishedHash.Sum())\n\t} else {\n\t\tif fips140tls.Required() {\n\t\t\tif fips140ems.Value() != \"0\" {\n\t\t\t\tc.sendAlert(alertHandshakeFailure)\n\t\t\t\treturn errors.New(\"tls: FIPS 140-3 requires the use of Extended Master Secret\")\n\t\t\t}\n\t\t\tfips140ems.IncNonDefault()\n\t\t}\n\t\ths.masterSecret = masterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret,\n\t\t\ths.clientHello.random, hs.hello.random)\n\t}\n\tif err := c.config.writeKeyLog(keyLogLabelTLS12, hs.clientHello.random, hs.masterSecret); err != nil {\n\t\tc.sendAlert(alertInternalError)\n\t\treturn err\n\t}\n\n\t// If we received a client cert in response to our certificate request message,\n\t// the client will send us a certificateVerifyMsg immediately after the\n\t// clientKeyExchangeMsg. This message is a digest of all preceding\n\t// handshake-layer messages that is signed using the private key corresponding\n\t// to the client's certificate. This allows us to verify that the client is in\n\t// possession of the private key of the certificate.\n\tif len(c.peerCertificates) > 0 {","sourceCodeStart":726,"sourceCodeEnd":762,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/handshake_server.go#L726-L762","documentation":"FIPS 140-3 mode is enabled and the negotiated TLS 1.2 handshake did not use extended_master_secret. FIPS 140-3 mandates EMS; the server rejects the handshake with handshake_failure when fips140ems is at its non-default (enforcing) value.","triggerScenarios":"In the TLS 1.2 master-secret derivation, hs.hello.extendedMasterSecret is false, fips140tls.Required() is true, and fips140ems.Value() != \"0\". The client either omitted EMS or stripped it.","commonSituations":"Operating in a FIPS-validated environment (Go compiled with GOEXPERIMENT=boringcrypto or the FIPS-enabled toolchain) where EMS is mandatory but the peer is a legacy/non-compliant client that does not advertise extended_master_secret.","solutions":["Require the client to advertise extended_master_secret (RFC 7627) — upgrade legacy clients.","If the deployment cannot avoid FIPS mode, all peers must support EMS; there is no bypass while keeping compliance.","To temporarily disable enforcement, set the fips140ems godebug to \"0\" — but this breaks FIPS compliance and should only be used for diagnostics.","Document the FIPS requirement in your deployment policy so client integrators know EMS is mandatory."],"exampleFix":"// Client fix: ensure extended_master_secret is advertised.\n// Go clients always advertise it for TLS 1.2; no action required.\n// Legacy OpenSSL clients: upgrade to >= 1.1.0 where EMS is default-on.\n\n// Diagnostic only (NOT for production — breaks FIPS):\n//   GODEBUG=fips140ems=0","handlingStrategy":"validation","validationCode":"// In FIPS mode, gate peer acceptance on EMS advertisement before handshake.\n// (Detection happens at handshake; ensure all deployed clients support EMS.)","typeGuard":null,"tryCatchPattern":"// Server in FIPS mode: catch and reject non-EMS clients.\nif err != nil && strings.Contains(err.Error(), \"FIPS 140-3 requires the use of Extended Master Secret\") {\n    return fmt.Errorf(\"client incompatible with FIPS policy: %w\", err)\n}","preventionTips":["Document that all clients of a FIPS-mode server must support EMS.","Run clients on TLS stacks >= OpenSSL 1.1.0 / current Go.","Avoid setting GODEBUG=fips140ems=0 in production — it breaks compliance."],"tags":["tls","server-handshake","fips140","fips","extended-master-secret","compliance","tls12"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}