gchq/CyberChef · error · OperationError

Data is not a valid TLS Server Hello. QUIC is not yet suppor

Error message

Data is not a valid TLS Server Hello. QUIC is not yet supported.\n${err}

What it means

Thrown by toJA4S, the Server Hello counterpart of toJA4. It wraps parseTLSRecord in a try/catch and requires handshakeType === 0x02 (ServerHello); any parse failure or non-ServerHello record is re-thrown as an OperationError with the original error appended. QUIC is not supported.

Source

Thrown at src/core/lib/JA4.mjs:175

        "JA4_ro": `${ptype}${version}${sni}${cipherLen}${extLen}${alpn}_${originalCiphersRaw}_${originalExtensionsRaw}`,
    };
}


/**
 * Calculate the JA4Server from a given TLS Server Hello Stream
 * @param {Uint8Array} bytes
 * @returns {string}
 */
export function toJA4S(bytes) {
    let tlsr = {};
    try {
        tlsr = parseTLSRecord(bytes);
        if (tlsr.handshake.value.handshakeType.value !== 0x02) {
            throw new Error();
        }
    } catch (err) {
        throw new OperationError("Data is not a valid TLS Server Hello. QUIC is not yet supported.\n" + err);
    }

    /* QUIC
        “q” or “t”, which denotes whether the hello packet is for QUIC or TCP.
        TODO: Implement QUIC
    */
    const ptype = "t";

    /* TLS Version
        TLS version is shown in 3 different places. If extension 0x002b exists (supported_versions), then the version
        is the highest value in the extension. Remember to ignore GREASE values. If the extension doesn’t exist, then
        the TLS version is the value of the Protocol Version. Handshake version (located at the top of the packet)
        should be ignored.
    */
    let version = tlsr.handshake.value.helloVersion.value;
    for (const ext of tlsr.handshake.value.extensions.value) {
        if (ext.type.value === "supported_versions") {
            version = parseHighestSupportedVersion(ext.value.data);

View on GitHub (pinned to 4290ea7539)

Solutions

1. Confirm the bytes are a Server Hello (handshake type 0x02) and a complete TLS record.
2. Use toJA4 for Client Hello inputs.
3. Reassemble the TCP stream before extracting the record.
4. Filter out QUIC traffic (use a QUIC-aware tool instead).

Example fix

// before
toJA4S(clientHelloBytes); // wrong direction

// after
toJA4(clientHelloBytes);

function looksLikeServerHello(bytes) {
  return bytes.length >= 11 &&
    bytes[0] === 0x16 &&               // ContentType: Handshake
    bytes[1] === 0x03 &&               // Protocol version TLS (3.x)
    bytes[5] === 0x02 &&               // HandshakeType: ServerHello
    Number.isInteger(bytes[6]);
}
if (!looksLikeServerHello(bytes)) throw new Error("Not a TLS Server Hello record");
toJA4S(bytes);

const isLikelyServerHello = bytes =>
  bytes.length >= 11 && bytes[0] === 0x16 && bytes[5] === 0x02;

try {
  toJA4S(bytes);
} catch (err) {
  if (err instanceof OperationError && /not a valid TLS Server Hello/.test(err.message)) {
    // wrong packet direction, truncated, QUIC, or non-TLS; re-select input
  } else throw err;
}

When it happens

Trigger: Passing a Client Hello (type 0x01), a Certificate/Alert/ApplicationData record, a QUIC Initial, a truncated capture, or non-TLS bytes.

Common situations: Selecting the wrong packet from a PCAP; feeding a Client Hello to the Server Hello function; QUIC traffic; incomplete TCP reassembly; encrypted record mistaken for a handshake.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Data is not a valid TLS Client Hello. QUIC is not yet suppor
• Not handshake data.
• Incorrect handshake length.
• Not enough data in Handshake message.
• Not a known handshake message.

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/d80bf6b961c48cbf. Report an issue: GitHub.