{"record":{"id":"66bef008b95fd4e0","repo":"golang/go","slug":"tls-server-sent-a-serverhello-extension-forbidden","errorCode":null,"errorMessage":"tls: server sent a ServerHello extension forbidden in TLS 1.3","messagePattern":"tls: server sent a ServerHello extension forbidden in TLS 1\\.3","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/handshake_client_tls13.go","lineNumber":191,"sourceCode":"\tif hs.serverHello.supportedVersion != VersionTLS13 {\n\t\tc.sendAlert(alertIllegalParameter)\n\t\treturn errors.New(\"tls: server selected an invalid version after a HelloRetryRequest\")\n\t}\n\n\tif hs.serverHello.vers != VersionTLS12 {\n\t\tc.sendAlert(alertIllegalParameter)\n\t\treturn errors.New(\"tls: server sent an incorrect legacy version\")\n\t}\n\n\tif hs.serverHello.ocspStapling ||\n\t\ths.serverHello.ticketSupported ||\n\t\ths.serverHello.extendedMasterSecret ||\n\t\ths.serverHello.secureRenegotiationSupported ||\n\t\tlen(hs.serverHello.secureRenegotiation) != 0 ||\n\t\tlen(hs.serverHello.alpnProtocol) != 0 ||\n\t\tlen(hs.serverHello.scts) != 0 {\n\t\tc.sendAlert(alertUnsupportedExtension)\n\t\treturn errors.New(\"tls: server sent a ServerHello extension forbidden in TLS 1.3\")\n\t}\n\n\tif !bytes.Equal(hs.hello.sessionId, hs.serverHello.sessionId) {\n\t\tc.sendAlert(alertIllegalParameter)\n\t\treturn errors.New(\"tls: server did not echo the legacy session ID\")\n\t}\n\n\tif hs.serverHello.compressionMethod != compressionNone {\n\t\tc.sendAlert(alertDecodeError)\n\t\treturn errors.New(\"tls: server sent non-zero legacy TLS compression method\")\n\t}\n\n\tselectedSuite := mutualCipherSuiteTLS13(hs.hello.cipherSuites, hs.serverHello.cipherSuite)\n\tif hs.suite != nil && selectedSuite != hs.suite {\n\t\tc.sendAlert(alertIllegalParameter)\n\t\treturn errors.New(\"tls: server changed cipher suite after a HelloRetryRequest\")\n\t}\n\tif selectedSuite == nil {","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/handshake_client_tls13.go#L173-L209","documentation":"Thrown in checkServerHelloOrHRR() when the TLS 1.3 ServerHello contains legacy extensions forbidden by RFC 8446: OCSP stapling, session ticket support, extended_master_secret, secure_renegotiation, ALPN protocol, or SCTs. In TLS 1.3 these belong in EncryptedExtensions or separate post-handshake messages, not in the ServerHello itself.","triggerScenarios":"Triggered when any of the following are set on hs.serverHello: ocspStapling, ticketSupported, extendedMasterSecret, secureRenegotiationSupported, non-empty secureRenegotiation, non-empty alpnProtocol, or non-empty scts. The client sends alertUnsupportedExtension.","commonSituations":"Server that incorrectly includes TLS 1.2-style extensions in a TLS 1.3 ServerHello. TLS-terminating proxy or middlebox injecting legacy extensions. Server implementation that shares extension-handling code between TLS 1.2 and 1.3 without filtering. Misconfigured reverse proxy.","solutions":["Server must follow RFC 8446 section 4.2 — these extensions must not appear in the TLS 1.3 ServerHello; they belong in EncryptedExtensions or separate messages.","Verify no TLS-terminating proxy (nginx, HAProxy, AWS ALB) is injecting legacy extensions.","Update the server or proxy software to a TLS 1.3-compliant version.","If unfixable, restrict client to TLS 1.2 to avoid the TLS 1.3 extension checks."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"conn, err := tls.Dial(\"tcp\", addr, config)\nif err != nil {\n    if strings.Contains(err.Error(), \"extension forbidden in TLS 1.3\") {\n        // Server sends legacy extensions — fall back to TLS 1.2\n        config.MaxVersion = tls.VersionTLS12\n        conn, err = tls.Dial(\"tcp\", addr, config)\n    }\n}","preventionTips":["Check for TLS-terminating proxies that inject legacy extensions.","Update server and proxy software to TLS 1.3-compliant versions.","Use testssl.sh or SSL Labs to scan server TLS configuration.","Maintain TLS 1.2 fallback for non-compliant servers."],"tags":["tls","go","tls13","extensions","protocol-violation","rfc8446"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}