shadow1ng/fscan · error

no peer certificates

Error message

no peer certificates

What it means

Raised in SocketLayer.TlsPubKey when the TLS handshake completed but ConnectionState().PeerCertificates is empty, so the RSA server key needed for RDP NLA cannot be extracted. Typically means the server resumed a session without sending certificates or a non-standard TLS peer.

Source

Thrown at libs/grdp/core/socket.go:74

		MaxVersion:               tls.VersionTLS13,
		PreferServerCipherSuites: true,
	}
	s.tlsConn = tls.Client(s.conn, config)
	return s.tlsConn.Handshake()
}

type PublicKey struct {
	N *big.Int `asn1:"explicit,tag:0"` // modulus
	E int      `asn1:"explicit,tag:1"` // public exponent
}

func (s *SocketLayer) TlsPubKey() ([]byte, error) {
	if s.tlsConn == nil {
		return nil, errors.New("TLS conn does not exist")
	}
	certs := s.tlsConn.ConnectionState().PeerCertificates
	if len(certs) == 0 {
		return nil, errors.New("no peer certificates")
	}
	pub, ok := certs[0].PublicKey.(*rsa.PublicKey)
	if !ok {
		return nil, errors.New("invalid public key type")
	}
	return asn1ber.Marshal(*pub)
}

View on GitHub (pinned to 95cc12e753)

Solutions

1. Disable TLS session resumption on the client config so certificates are presented
2. Retry the connection; some servers intermittently omit certificates
3. Fall back to standard RDP security negotiation instead of NLA/CredSSP

When it happens

Trigger: Thrown at libs/grdp/core/socket.go:74 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/09df91198f20ef1e. Report an issue: GitHub.