{"record":{"id":"c41667a273f102b9","repo":"golang/go","slug":"tls-initial-handshake-had-non-empty-renegotiation-c41667","errorCode":null,"errorMessage":"tls: initial handshake had non-empty renegotiation extension","messagePattern":"tls: initial handshake had non-empty renegotiation extension","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/handshake_server.go","lineNumber":255,"sourceCode":"\t// Downgrade protection canaries. See RFC 8446, Section 4.1.3.\n\tmaxVers := c.config.maxSupportedVersion(roleServer, c.quic != nil)\n\tif maxVers >= VersionTLS12 && c.vers < maxVers || testingOnlyForceDowngradeCanary {\n\t\tif c.vers == VersionTLS12 {\n\t\t\tcopy(serverRandom[24:], downgradeCanaryTLS12)\n\t\t} else {\n\t\t\tcopy(serverRandom[24:], downgradeCanaryTLS11)\n\t\t}\n\t\tserverRandom = serverRandom[:24]\n\t}\n\t_, err := io.ReadFull(c.config.rand(), serverRandom)\n\tif err != nil {\n\t\tc.sendAlert(alertInternalError)\n\t\treturn err\n\t}\n\n\tif len(hs.clientHello.secureRenegotiation) != 0 {\n\t\tc.sendAlert(alertHandshakeFailure)\n\t\treturn errors.New(\"tls: initial handshake had non-empty renegotiation extension\")\n\t}\n\n\ths.hello.extendedMasterSecret = hs.clientHello.extendedMasterSecret\n\ths.hello.secureRenegotiationSupported = hs.clientHello.secureRenegotiationSupported\n\ths.hello.compressionMethod = compressionNone\n\tif len(hs.clientHello.serverName) > 0 {\n\t\tc.serverName = hs.clientHello.serverName\n\t}\n\n\tselectedProto, err := negotiateALPN(c.config.NextProtos, hs.clientHello.alpnProtocols, false)\n\tif err != nil {\n\t\tc.sendAlert(alertNoApplicationProtocol)\n\t\treturn err\n\t}\n\ths.hello.alpnProtocol = selectedProto\n\tc.clientProtocol = selectedProto\n\n\ths.cert, err = c.config.getCertificate(clientHelloInfo(hs.ctx, c, hs.clientHello))","sourceCodeStart":237,"sourceCodeEnd":273,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/handshake_server.go#L237-L273","documentation":"On an initial (non-renegotiation) handshake, the client sent a non-empty secure_renegotiation extension data field. RFC 5746 requires that field to be empty on the first handshake; only renegotiation handshakes carry the previous verify_data. Sending renegotiation data on the initial handshake is a handshake_failure.","triggerScenarios":"processClientHello checks len(hs.clientHello.secureRenegotiation) != 0 on the initial handshake and alerts. The peer transmitted a renegotiation_info extension with non-empty contents on its first ClientHello.","commonSituations":"A buggy client reusing renegotiation state across connections, a TLS stack that incorrectly seeds the renegotiation field, or a malicious peer probing for CVE-2009-3555 style renegotiation vulnerabilities.","solutions":["Use a compliant client library — RFC 5746 mandates an empty renegotiation_info on the initial handshake.","Restart the client's TLS state (clear cached sessions/renegotiation context) and reconnect.","If the client is your own, audit how renegotiation_info is populated before the first handshake completes.","Treat persistent occurrences as a sign of a tampered or malicious client."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Client: ensure renegotiation_info is empty on the initial handshake.\n// Standard libraries do this; if you maintain a custom stack, never seed\n// renegotiation data before the first handshake completes.","typeGuard":null,"tryCatchPattern":"// Server: log as a protocol anomaly.\nif err != nil && strings.Contains(err.Error(), \"non-empty renegotiation extension\") {\n    log.Warn(\"possible CVE-2009-3555 probe\", \"remote\", conn.RemoteAddr())\n}","preventionTips":["Reset renegotiation state on every new connection.","Update legacy TLS stacks to RFC 5746-compliant versions.","Monitor for scanning activity that triggers this alert."],"tags":["tls","server-handshake","renegotiation","rfc-5746","protocol-violation","tls12"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}