gravitational/teleport · error

peer certificate is missing

Error message

peer certificate is missing

What it means

In the RDP client's TLS upgrade, this fires when the server did not present a certificate at all (peer certificate missing) during the non-FIPS verification path — the RDP server closed or misbehaved during the TLS handshake, so identity verification cannot proceed.

Source

Thrown at lib/srv/desktop/rdp/rdpclient/src/ssl.rs:55

    initial_stream: TcpStream,
    server_name: &str,
) -> ClientResult<(TlsStream<TcpStream>, Vec<u8>)> {
    #[cfg(feature = "fips")]
    {
        use boring::ssl::{SslConnector, SslMethod, SslVerifyMode};
        use std::io;
        use tokio::io::AsyncWriteExt;
        let mut builder = SslConnector::builder(SslMethod::tls_client())?;
        builder.set_verify(SslVerifyMode::NONE);
        builder.set_fips_compliance_policy()?;
        let configuration = builder.build().configure()?;
        let mut tls_stream =
            tokio_boring::connect(configuration, server_name, initial_stream).await?;
        tls_stream.flush().await?;
        let cert = tls_stream
            .ssl()
            .peer_certificate()
            .ok_or_else(|| io::Error::new(io::ErrorKind::Other, "peer certificate is missing"))?;
        let public_key = cert.public_key()?;
        let mut bytes: Vec<u8> = public_key.public_key_to_der()?;
        // boring uses additional DER element before raw key data compared to rustls, so we have to skip it
        if bytes.len() >= 24 {
            bytes.drain(0..24);
        }
        Ok((tls_stream, bytes))
    }
    #[cfg(not(feature = "fips"))]
    ironrdp_tls::upgrade(initial_stream, server_name)
        .await
        .map_err(ClientError::from)
        .and_then(|upgraded| {
            // TODO (rhammonds): This is a temporary workaround to get our RDP client
            // working against the latest changes from IronRDP. We should consider changing
            // the return value of this function (and the calling code) to handle
            // a CertificateInner rather than just the raw public key.
            Ok((

View on GitHub (pinned to 1283425b60)

Solutions

1. Verify the RDP server supports and is configured for TLS (NLA/TLS)
2. Check the server address/port and that a firewall is not intercepting the connection
3. Inspect the RDP server's TLS/certificate configuration

When it happens

Trigger: Thrown at lib/srv/desktop/rdp/rdpclient/src/ssl.rs:55 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/14749baa2f84a3e3. Report an issue: GitHub.