gchq/CyberChef · error · OperationError

Data is not a valid TLS Client Hello. QUIC is not yet suppor

Error message

Data is not a valid TLS Client Hello. QUIC is not yet supported.
${err}

What it means

Thrown by toJA4 when the input cannot be parsed as a TLS Client Hello. The function wraps parseTLSRecord in a try/catch and additionally requires handshakeType === 0x01 (ClientHello); any parse failure (truncated record, non-TLS data, wrong handshake type) or a non-ClientHello record is re-thrown as an OperationError with the original error appended. QUIC Initial packets are explicitly not supported.

Source

Thrown at src/core/lib/JA4.mjs:32

import { toHexFast } from "./Hex.mjs";
import { runHash } from "./Hash.mjs";
import Utils from "../Utils.mjs";


/**
 * Calculate the JA4 from a given TLS Client Hello Stream
 * @param {Uint8Array} bytes
 * @returns {string}
 */
export function toJA4(bytes) {
    let tlsr = {};
    try {
        tlsr = parseTLSRecord(bytes);
        if (tlsr.handshake.value.handshakeType.value !== 0x01) {
            throw new Error();
        }
    } catch (err) {
        throw new OperationError("Data is not a valid TLS Client Hello. QUIC is not yet supported.\n" + err);
    }

    /* QUIC
        “q” or “t”, which denotes whether the hello packet is for QUIC or TCP.
        TODO: Implement QUIC
    */
    const ptype = "t";

    /* TLS Version
        TLS version is shown in 3 different places. If extension 0x002b exists (supported_versions), then the version
        is the highest value in the extension. Remember to ignore GREASE values. If the extension doesn’t exist, then
        the TLS version is the value of the Protocol Version. Handshake version (located at the top of the packet)
        should be ignored.
    */
    let version = tlsr.handshake.value.helloVersion.value;
    for (const ext of tlsr.handshake.value.extensions.value) {
        if (ext.type.value === "supported_versions") {
            version = parseHighestSupportedVersion(ext.value.data);

View on GitHub (pinned to 4290ea7539)

Solutions

1. Confirm the bytes are a Client Hello (handshake type 0x01) and a complete TLS record.
2. Use toJA4S for Server Hello inputs.
3. Reassemble the TCP stream before extracting the record.
4. Filter out QUIC traffic (use a QUIC-aware tool instead).

Example fix

// before
toJA4(serverHelloBytes); // wrong direction

// after
toJA4S(serverHelloBytes);

// Cheap TLS Client Hello sanity check (record + handshake + type 0x01).
function looksLikeClientHello(bytes) {
  return bytes.length >= 11 &&
    bytes[0] === 0x16 &&               // ContentType: Handshake
    bytes[1] === 0x03 &&               // Protocol version TLS (3.x)
    bytes[5] === 0x01 &&               // HandshakeType: ClientHello
    Number.isInteger(bytes[6]);
}
if (!looksLikeClientHello(bytes)) throw new Error("Not a TLS Client Hello record");
toJA4(bytes);

const isLikelyClientHello = bytes =>
  bytes.length >= 11 && bytes[0] === 0x16 && bytes[5] === 0x01;

try {
  toJA4(bytes);
} catch (err) {
  if (err instanceof OperationError && /not a valid TLS Client Hello/.test(err.message)) {
    // wrong packet direction, truncated, QUIC, or non-TLS; re-select input
  } else throw err;
}

When it happens

Trigger: Passing a TLS Server Hello (type 0x02), a Certificate/Alert/ApplicationData record, a QUIC Initial packet, a truncated/partial capture, an encrypted record, or non-TLS bytes (e.g. HTTP).

Common situations: Selecting the wrong packet from a PCAP; feeding a reassembled-but-wrong-direction record; QUIC traffic; missing TCP reassembly so the record is incomplete; encrypted data mistaken for a handshake.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Data is not a valid TLS Server Hello. QUIC is not yet suppor
• Not handshake data.
• Incorrect handshake length.
• Not enough data in Handshake message.
• Not a known handshake message.

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/2cb9853c1d770ac5. Report an issue: GitHub.