{"record":{"id":"94be89deca4ac68a","repo":"golang/go","slug":"tls-server-did-not-send-a-key-share","errorCode":null,"errorMessage":"tls: server did not send a key share","messagePattern":"tls: server did not send a key share","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/handshake_client_tls13.go","lineNumber":432,"sourceCode":"\n\tif bytes.Equal(hs.serverHello.random, helloRetryRequestRandom) {\n\t\tc.sendAlert(alertUnexpectedMessage)\n\t\treturn errors.New(\"tls: server sent two HelloRetryRequest messages\")\n\t}\n\n\tif len(hs.serverHello.cookie) != 0 {\n\t\tc.sendAlert(alertUnsupportedExtension)\n\t\treturn errors.New(\"tls: server sent a cookie in a normal ServerHello\")\n\t}\n\n\tif hs.serverHello.selectedGroup != 0 {\n\t\tc.sendAlert(alertDecodeError)\n\t\treturn errors.New(\"tls: malformed key_share extension\")\n\t}\n\n\tif hs.serverHello.serverShare.group == 0 {\n\t\tc.sendAlert(alertIllegalParameter)\n\t\treturn errors.New(\"tls: server did not send a key share\")\n\t}\n\tif !slices.ContainsFunc(hs.hello.keyShares, func(ks keyShare) bool {\n\t\treturn ks.group == hs.serverHello.serverShare.group\n\t}) {\n\t\tc.sendAlert(alertIllegalParameter)\n\t\treturn errors.New(\"tls: server selected unsupported group\")\n\t}\n\n\tif !hs.serverHello.selectedIdentityPresent {\n\t\treturn nil\n\t}\n\n\tif int(hs.serverHello.selectedIdentity) >= len(hs.hello.pskIdentities) {\n\t\tc.sendAlert(alertIllegalParameter)\n\t\treturn errors.New(\"tls: server selected an invalid PSK\")\n\t}\n\n\tif len(hs.hello.pskIdentities) != 1 || hs.session == nil {","sourceCodeStart":414,"sourceCodeEnd":450,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/handshake_client_tls13.go#L414-L450","documentation":"processServerHello requires the ServerHello to contain a server key share. If serverShare.group == 0, the key_share extension is missing or empty, so Go sends `illegal_parameter`. A TLS 1.3 ServerHello without a key share is non-conformant.","triggerScenarios":"ServerHello.keyShare/serverShare parsed with group 0 — either the extension was absent or it was empty. Reached for any TLS 1.3 ServerHello missing the key_share extension.","commonSituations":"Server that negotiated TLS 1.3 but failed to send key_share (e.g., misrouted PSK-only handshake, server bug), a downgrade-attack scenario, or a faulty proxy stripping extensions.","solutions":["Confirm the server actually speaks TLS 1.3 and is not silently downgrading to 1.2.","Capture the handshake and verify key_share is present in the ServerHello bytes.","Check for TLS-terminating proxies that rewrite or drop extensions.","Report to the server operator — TLS 1.3 ServerHello must include a key_share."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"conn, err := tls.Dial(\"tcp\", addr, cfg)\nif err != nil {\n    if strings.Contains(err.Error(), \"did not send a key share\") {\n        // possibly a server that downgraded to TLS 1.2 silently or a stripping proxy\n        log.Printf(\"peer %s omitted ServerHello key_share\", addr)\n    }\n    return err\n}","preventionTips":["Set Config.MinVersion = tls.VersionTLS13 so silent TLS 1.2 downgrades are rejected explicitly rather than masquerading as 1.3 faults.","Audit the network path for proxies that strip extensions.","Validate the server's TLS 1.3 support with a reference client (openssl s_client)."],"tags":["tls","tls13","handshake","key-share","protocol-violation","network","go"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}