shadow1ng/fscan · error

TLS conn does not exist

Error message

TLS conn does not exist

What it means

Guard in SocketLayer.TlsPubKey: it needs the server's TLS certificate public key for RDP NLA/CredSSP, but s.tlsConn is nil because StartTLS() was never called (or failed) before extracting the peer public key.

Source

Thrown at libs/grdp/core/socket.go:70

func (s *SocketLayer) StartTLS() error {
	config := &tls.Config{
		InsecureSkipVerify:       true,
		MinVersion:               tls.VersionTLS10,
		MaxVersion:               tls.VersionTLS13,
		PreferServerCipherSuites: true,
	}
	s.tlsConn = tls.Client(s.conn, config)
	return s.tlsConn.Handshake()
}

type PublicKey struct {
	N *big.Int `asn1:"explicit,tag:0"` // modulus
	E int      `asn1:"explicit,tag:1"` // public exponent
}

func (s *SocketLayer) TlsPubKey() ([]byte, error) {
	if s.tlsConn == nil {
		return nil, errors.New("TLS conn does not exist")
	}
	certs := s.tlsConn.ConnectionState().PeerCertificates
	if len(certs) == 0 {
		return nil, errors.New("no peer certificates")
	}
	pub, ok := certs[0].PublicKey.(*rsa.PublicKey)
	if !ok {
		return nil, errors.New("invalid public key type")
	}
	return asn1ber.Marshal(*pub)
}

View on GitHub (pinned to 95cc12e753)

Solutions

1. Call SocketLayer.StartTLS() and confirm Handshake() returned nil before TlsPubKey()
2. If the handshake failed, address the underlying TLS error (protocol version, network) first
3. Skip NLA negotiation and fall back to standard RDP security if CredSSP is not required

When it happens

Trigger: Thrown at libs/grdp/core/socket.go:70 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/6f3f3c701ab4006b. Report an issue: GitHub.