{"record":{"id":"f504094c92198208","repo":"golang/go","slug":"tls-received-a-session-ticket-with-invalid-lifeti","errorCode":null,"errorMessage":"tls: received a session ticket with invalid lifetime","messagePattern":"tls: received a session ticket with invalid lifetime","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/handshake_client_tls13.go","lineNumber":854,"sourceCode":"\nfunc (c *Conn) handleNewSessionTicket(msg *newSessionTicketMsgTLS13) error {\n\tif !c.isClient {\n\t\tc.sendAlert(alertUnexpectedMessage)\n\t\treturn errors.New(\"tls: received new session ticket from a client\")\n\t}\n\n\tif c.config.SessionTicketsDisabled || c.config.ClientSessionCache == nil {\n\t\treturn nil\n\t}\n\n\t// See RFC 8446, Section 4.6.1.\n\tif msg.lifetime == 0 {\n\t\treturn nil\n\t}\n\tlifetime := time.Duration(msg.lifetime) * time.Second\n\tif lifetime > maxSessionTicketLifetime {\n\t\tc.sendAlert(alertIllegalParameter)\n\t\treturn errors.New(\"tls: received a session ticket with invalid lifetime\")\n\t}\n\n\tif len(msg.label) == 0 {\n\t\tc.sendAlert(alertDecodeError)\n\t\treturn errors.New(\"tls: received a session ticket with empty opaque ticket label\")\n\t}\n\n\t// RFC 9001, Section 4.6.1\n\tif c.quic != nil && msg.maxEarlyData != 0 && msg.maxEarlyData != 0xffffffff {\n\t\tc.sendAlert(alertIllegalParameter)\n\t\treturn errors.New(\"tls: invalid early data for QUIC connection\")\n\t}\n\n\tcipherSuite := cipherSuiteTLS13ByID(c.cipherSuite)\n\tif cipherSuite == nil || c.resumptionSecret == nil {\n\t\treturn c.sendAlert(alertInternalError)\n\t}\n","sourceCodeStart":836,"sourceCodeEnd":872,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/handshake_client_tls13.go#L836-L872","documentation":"A TLS 1.3 client received a NewSessionTicket whose lifetime field exceeds maxSessionTicketLifetime (7 days, per RFC 8446 §4.6.1). The server is forbidden from advertising a ticket valid longer than seven days; doing so is an illegal_parameter alert condition.","triggerScenarios":"handleNewSessionTicket computes lifetime = msg.lifetime seconds and compares against maxSessionTicketLifetime; if larger, it sends alertIllegalParameter. The peer server sent a ticket_lifetime greater than 604800 seconds.","commonSituations":"A misconfigured or non-compliant server (custom TLS stack, some older OpenSSL forks, or a testing harness) advertising oversized lifetimes. Legitimate servers cap at 7 days.","solutions":["Report the bug to the server operator; RFC 8446 caps ticket_lifetime at 7 days.","If you control the server, set ticket lifetime to <= 604800 seconds (commonly 86400 for 24h).","Continue without session resumption — the client aborts this ticket but can negotiate a fresh full handshake.","If interoperating with a known-broken peer, file an upstream issue rather than suppressing the alert."],"exampleFix":"// server-side fix (Go)\ncfg := &tls.Config{\n    SessionTicketsDisabled: false,\n    // Go enforces maxSessionTicketLifetime internally; do not try to override.\n}\n// If using a custom ticket store, ensure issued tickets carry lifetime <= 7*24*time.Hour.","handlingStrategy":"validation","validationCode":"// Server-side: cap ticket lifetime at issuance to the RFC maximum.\nconst maxLifetime = 7 * 24 * time.Hour // 604800s\n// Go enforces this; if you maintain a custom ticket store, never write a\n// ticket with lifetime > maxLifetime.","typeGuard":null,"tryCatchPattern":"cfg := &tls.Config{ClientSessionCache: tls.NewClientSessionCache(0)}\n// On handshake error:\nif err != nil && strings.Contains(err.Error(), \"invalid lifetime\") {\n    // peer bug; report upstream, disable resumption against this host\n    cfg.ClientSessionCache = nil\n}","preventionTips":["When implementing a custom NewSessionTicket issuer, hard-code lifetime <= 7 days.","Document resumption expectations with peer operators.","Run interop tests against known-good clients/servers."],"tags":["tls","client-handshake","session-ticket","protocol-violation","tls13","rfc-8446"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}