{"record":{"id":"d8e3a074ac4e40e9","repo":"golang/go","slug":"tls-incorrect-renegotiation-extension-contents","errorCode":null,"errorMessage":"tls: incorrect renegotiation extension contents","messagePattern":"tls: incorrect renegotiation extension contents","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/crypto/tls/handshake_client.go","lineNumber":920,"sourceCode":"\tif !supportsPointFormat && offeredNonCompressedFormat {\n\t\treturn false, errors.New(\"tls: server offered only incompatible point formats\")\n\t}\n\n\tif c.handshakes == 0 && hs.serverHello.secureRenegotiationSupported {\n\t\tc.secureRenegotiation = true\n\t\tif len(hs.serverHello.secureRenegotiation) != 0 {\n\t\t\tc.sendAlert(alertHandshakeFailure)\n\t\t\treturn false, errors.New(\"tls: initial handshake had non-empty renegotiation extension\")\n\t\t}\n\t}\n\n\tif c.handshakes > 0 && c.secureRenegotiation {\n\t\tvar expectedSecureRenegotiation [24]byte\n\t\tcopy(expectedSecureRenegotiation[:], c.clientFinished[:])\n\t\tcopy(expectedSecureRenegotiation[12:], c.serverFinished[:])\n\t\tif !bytes.Equal(hs.serverHello.secureRenegotiation, expectedSecureRenegotiation[:]) {\n\t\t\tc.sendAlert(alertHandshakeFailure)\n\t\t\treturn false, errors.New(\"tls: incorrect renegotiation extension contents\")\n\t\t}\n\t}\n\n\tif err := checkALPN(hs.hello.alpnProtocols, hs.serverHello.alpnProtocol, false); err != nil {\n\t\tc.sendAlert(alertUnsupportedExtension)\n\t\treturn false, err\n\t}\n\tc.clientProtocol = hs.serverHello.alpnProtocol\n\n\tc.scts = hs.serverHello.scts\n\n\tif !hs.serverResumedSession() {\n\t\treturn false, nil\n\t}\n\n\tif hs.session.version != c.vers {\n\t\tc.sendAlert(alertHandshakeFailure)\n\t\treturn false, errors.New(\"tls: server resumed a session with a different version\")","sourceCodeStart":902,"sourceCodeEnd":938,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/handshake_client.go#L902-L938","documentation":"On a renegotiation (c.handshakes > 0) where secure renegotiation was previously established, RFC 5746 requires the server's renegotiation_info to equal clientFinished[0:12] concatenated with serverFinished[12:24] from the prior handshake. The code constructs expectedSecureRenegotiation and compares with bytes.Equal; a mismatch indicates tampering or a broken channel and is aborted with alertHandshakeFailure.","triggerScenarios":"MitM attempting to splice or synchronize renegotiation state; buggy middlebox that corrupts renegotiation_info; certificate rotation that breaks state continuity across renegotiations.","commonSituations":"TLS interception appliances on long-lived renegotiating connections; rarely legitimate servers.","solutions":["Move to TLS 1.3 which has no renegotiation and removes this attack surface (MinVersion = VersionTLS13).","Remove any TLS-intercepting appliance from the path of renegotiating connections.","If renegotiation is required, ensure the path is transparent."],"exampleFix":"// before: permissive renegotiation policy\ncfg := &tls.Config{Renegotiation: tls.RenegotiateFreelyAsClient}\n// after: TLS 1.3 eliminates renegotiation entirely\ncfg := &tls.Config{MinVersion: tls.VersionTLS13}","handlingStrategy":"validation","validationCode":"// Eliminate the renegotiation attack surface entirely.\nfunc disableRenegotiation(cfg *tls.Config) {\n    cfg.MinVersion = tls.VersionTLS13\n}","typeGuard":"func isIncorrectRenegotiationContents(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"incorrect renegotiation extension contents\")\n}","tryCatchPattern":"if _, err := tls.Dial(\"tcp\", addr, cfg); err != nil {\n    if isIncorrectRenegotiationContents(err) {\n        // Likely interception on a renegotiating connection; do not retry silently.\n        security.ReportInterception(addr, err)\n    }\n}","preventionTips":["Use TLS 1.3 to remove renegotiation entirely.","Audit paths for TLS-intercepting appliances.","Disable renegotiation where possible."],"tags":["tls","renegotiation","security","protocol"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}