{"record":{"id":"e1fe8b2716c903b1","repo":"golang/go","slug":"tls-server-selected-tls-1-3-using-the-legacy-vers","errorCode":null,"errorMessage":"tls: server selected TLS 1.3 using the legacy version field","messagePattern":"tls: server selected TLS 1\\.3 using the legacy version field","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/handshake_client_tls13.go","lineNumber":170,"sourceCode":"\n\tif hs.echContext != nil && hs.echContext.echRejected {\n\t\tc.sendAlert(alertECHRequired)\n\t\treturn &ECHRejectionError{hs.echContext.retryConfigs}\n\t}\n\n\tc.isHandshakeComplete.Store(true)\n\n\treturn nil\n}\n\n// checkServerHelloOrHRR does validity checks that apply to both ServerHello and\n// HelloRetryRequest messages. It sets hs.suite.\nfunc (hs *clientHandshakeStateTLS13) checkServerHelloOrHRR() error {\n\tc := hs.c\n\n\tif hs.serverHello.supportedVersion == 0 {\n\t\tc.sendAlert(alertMissingExtension)\n\t\treturn errors.New(\"tls: server selected TLS 1.3 using the legacy version field\")\n\t}\n\n\tif hs.serverHello.supportedVersion != VersionTLS13 {\n\t\tc.sendAlert(alertIllegalParameter)\n\t\treturn errors.New(\"tls: server selected an invalid version after a HelloRetryRequest\")\n\t}\n\n\tif hs.serverHello.vers != VersionTLS12 {\n\t\tc.sendAlert(alertIllegalParameter)\n\t\treturn errors.New(\"tls: server sent an incorrect legacy version\")\n\t}\n\n\tif hs.serverHello.ocspStapling ||\n\t\ths.serverHello.ticketSupported ||\n\t\ths.serverHello.extendedMasterSecret ||\n\t\ths.serverHello.secureRenegotiationSupported ||\n\t\tlen(hs.serverHello.secureRenegotiation) != 0 ||\n\t\tlen(hs.serverHello.alpnProtocol) != 0 ||","sourceCodeStart":152,"sourceCodeEnd":188,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/handshake_client_tls13.go#L152-L188","documentation":"Thrown in checkServerHelloOrHRR() when the ServerHello's supported_versions extension value is zero (absent). TLS 1.3 requires version negotiation via the supported_versions extension (RFC 8446 section 4.2.1) — using only the legacy record version field is not permitted.","triggerScenarios":"Triggered when hs.serverHello.supportedVersion == 0. This means the server attempted to negotiate TLS 1.3 using only the legacy version field (0x0303) without including the mandatory supported_versions extension in the ServerHello.","commonSituations":"Non-compliant server that does not implement the supported_versions extension. TLS middlebox or proxy stripping extensions from the ServerHello. Server implementation that predates TLS 1.3 and incorrectly sets the version field. Broken TLS terminator in a load balancer.","solutions":["Server must include a supported_versions extension with 0x0304 (TLS 1.3) in the ServerHello.","If the server cannot be fixed, restrict the client to TLS 1.2: set MaxVersion: tls.VersionTLS12.","Check for middlebox interference — test with a direct connection.","Report as a server compliance bug to the server software vendor."],"exampleFix":"// before — client offers TLS 1.3, server doesn't implement supported_versions\nconfig := &tls.Config{\n    MinVersion: tls.VersionTLS13,\n}\n\n// after — fall back to TLS 1.2 if server is non-compliant\nconfig := &tls.Config{\n    MinVersion: tls.VersionTLS12,\n    MaxVersion: tls.VersionTLS12,\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Version negotiation errors are untyped strings\nconn, err := tls.Dial(\"tcp\", addr, config)\nif err != nil {\n    if strings.Contains(err.Error(), \"using the legacy version field\") {\n        // Server doesn't implement supported_versions — fall back to TLS 1.2\n        config.MaxVersion = tls.VersionTLS12\n        conn, err = tls.Dial(\"tcp\", addr, config)\n    }\n}","preventionTips":["Test server TLS 1.3 compliance with openssl s_client -tls1_3 before deploying.","Have a fallback TLS 1.2 configuration ready for non-compliant servers.","Monitor for middlebox interference stripping TLS extensions."],"tags":["tls","go","tls13","version-negotiation","protocol-violation","rfc8446"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}