{"record":{"id":"95c5cd0a59e02e7b","repo":"golang/go","slug":"tls-fips-140-3-requires-the-use-of-extended-maste","errorCode":null,"errorMessage":"tls: FIPS 140-3 requires the use of Extended Master Secret","messagePattern":"tls: FIPS 140-3 requires the use of Extended Master Secret","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/handshake_client.go","lineNumber":778,"sourceCode":"\tif err != nil {\n\t\tc.sendAlert(alertInternalError)\n\t\treturn err\n\t}\n\tif ckx != nil {\n\t\tif _, err := hs.c.writeHandshakeRecord(ckx, &hs.finishedHash); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\tif hs.serverHello.extendedMasterSecret {\n\t\tc.extMasterSecret = true\n\t\ths.masterSecret = extMasterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret,\n\t\t\ths.finishedHash.Sum())\n\t} else {\n\t\tif fips140tls.Required() {\n\t\t\tif fips140ems.Value() != \"0\" {\n\t\t\t\tc.sendAlert(alertHandshakeFailure)\n\t\t\t\treturn errors.New(\"tls: FIPS 140-3 requires the use of Extended Master Secret\")\n\t\t\t}\n\t\t\tfips140ems.IncNonDefault()\n\t\t}\n\t\ths.masterSecret = masterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret,\n\t\t\ths.hello.random, hs.serverHello.random)\n\t}\n\tif err := c.config.writeKeyLog(keyLogLabelTLS12, hs.hello.random, hs.masterSecret); err != nil {\n\t\tc.sendAlert(alertInternalError)\n\t\treturn errors.New(\"tls: failed to write to key log: \" + err.Error())\n\t}\n\n\tif chainToSend != nil && len(chainToSend.Certificate) > 0 {\n\t\tcertVerify := &certificateVerifyMsg{}\n\n\t\tkey, ok := chainToSend.PrivateKey.(crypto.Signer)\n\t\tif !ok {\n\t\t\tc.sendAlert(alertInternalError)\n\t\t\treturn fmt.Errorf(\"tls: client certificate private key of type %T does not implement crypto.Signer\", chainToSend.PrivateKey)","sourceCodeStart":760,"sourceCodeEnd":796,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/handshake_client.go#L760-L796","documentation":"When the FIPS 140-3 module is required (fips140tls.Required() returns true), the server declining Extended Master Secret (RFC 7627) on a TLS 1.2 handshake is a hard violation unless the GODEBUG switch fips140ems is explicitly set to \"0\". Without EMS the master secret uses the legacy derivation, which FIPS 140-3 disallows.","triggerScenarios":"Connecting from a FIPS-required Go build (GOEXPERIMENT=fips140 / GODEBUG=fips140=on) to a TLS 1.2 server whose ServerHello did not include the extended_master_session extension; the else-branch fires.","commonSituations":"FIPS-compliance-enforced deployments (government, finance, healthcare) talking to legacy or non-compliant servers; misconfigured GODEBUG FIPS settings.","solutions":["Upgrade/patch the server to support Extended Master Secret (RFC 7627) — almost all modern servers do.","If site policy permits the relaxation, set GODEBUG=tlsems=0 (fips140ems=0) — but this breaks FIPS 140-3 compliance of the connection.","Confirm GODEBUG=fips140=on is actually required for this workload; remove it if not.","Prefer TLS 1.3, where EMS semantics are mandatory."],"exampleFix":"// Prefer fixing the server. If policy allows relaxation, document the trade-off:\n//   GODEBUG=tlsems=0 go run ./cmd\n// Otherwise move the peer to TLS 1.3.\ncfg := &tls.Config{MinVersion: tls.VersionTLS13}","handlingStrategy":"validation","validationCode":"// Confirm FIPS posture is intentional and that you are not over-restricting.\n// If the peer lacks EMS, either fix the peer or explicitly opt out (non-FIPS).\n// GODEBUG=tlsems=0 disables the requirement but breaks FIPS 140-3 compliance.","typeGuard":"func isFIPSEMSRequired(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"FIPS 140-3 requires the use of Extended Master Secret\")\n}","tryCatchPattern":"if _, err := tls.Dial(\"tcp\", addr, cfg); err != nil {\n    if isFIPSEMSRequired(err) {\n        // Do not silently relax: decide whether FIPS is truly required here.\n        log.Printf(\"compliance: peer %s lacks EMS; refusing under FIPS policy\", addr)\n    }\n}","preventionTips":["Confirm GODEBUG=fips140=on is required before relying on it.","Ensure peers support RFC 7627 EMS.","Prefer TLS 1.3 where EMS is mandatory."],"tags":["tls","fips","ems","compliance","security"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}