SSL Error Codes as noted in the Transport Layer Security protocol, RFC 2246

(Last modified: 30Oct2002)

This document (10073421) is provided subject to the disclaimer at the end of this document.

goal

fact

LDAP/SSL - Novell Directory Services

note

Error alert numbers

           close_notify(0),
           unexpected_message(10),
           bad_record_mac(20),
           decryption_failed(21),
           record_overflow(22),
           decompression_failure(30),
           handshake_failure(40),
           bad_certificate(42),
           unsupported_certificate(43),
           certificate_revoked(44),
           certificate_expired(45),
           certificate_unknown(46),
           illegal_parameter(47),
           unknown_ca(48),
           access_denied(49),
           decode_error(50),
           decrypt_error(51),
           export_restriction(60),
           protocol_version(70),
           insufficient_security(71),
           internal_error(80),
           user_canceled(90),
           no_renegotiation(100),

7.2.2. Error alerts

   Error handling in the TLS Handshake protocol is very simple. When an
   error is detected, the detecting party sends a message to the other
   party. Upon transmission or receipt of an fatal alert message, both
   parties immediately close the connection. Servers and clients are
   required to forget any session-identifiers, keys, and secrets
   associated with a failed connection. The following error alerts are
   defined:

   unexpected_message
       An inappropriate message was received. This alert is always fatal
       and should never be observed in communication between proper
       implementations.

   bad_record_mac
       This alert is returned if a record is received with an incorrect
       MAC. This message is always fatal.

   decryption_failed
       A TLSCiphertext decrypted in an invalid way: either it wasn`t an
       even multiple of the block length or its padding values, when
       checked, weren`t correct. This message is always fatal.

   record_overflow
       A TLSCiphertext record was received which had a length more than
       2^14+2048 bytes, or a record decrypted to a TLSCompressed record
       with more than 2^14+1024 bytes. This message is always fatal.

   decompression_failure
       The decompression function received improper input (e.g. data
       that would expand to excessive length). This message is always
       fatal.

   handshake_failure
       Reception of a handshake_failure alert message indicates that the
       sender was unable to negotiate an acceptable set of security
       parameters given the options available. This is a fatal error.

   bad_certificate
       A certificate was corrupt, contained signatures that did not
       verify correctly, etc.

unsupported_certificate
A certificate was of an unsupported type.

certificate_revoked
A certificate was revoked by its signer.

certificate_expired
A certificate has expired or is not currently valid.

   certificate_unknown
       Some other (unspecified) issue arose in processing the
       certificate, rendering it unacceptable.

   illegal_parameter
       A field in the handshake was out of range or inconsistent with
       other fields. This is always fatal.

   unknown_ca
       A valid certificate chain or partial chain was received, but the
       certificate was not accepted because the CA certificate could not
       be located or couldn`t be matched with a known, trusted CA. This
       message is always fatal.

   access_denied
       A valid certificate was received, but when access control was
       applied, the sender decided not to proceed with negotiation.
       This message is always fatal.

   decode_error
       A message could not be decoded because some field was out of the
       specified range or the length of the message was incorrect. This
       message is always fatal.

   decrypt_error
       A handshake cryptographic operation failed, including being
       unable to correctly verify a signature, decrypt a key exchange,
       or validate a finished message.

   export_restriction
       A negotiation not in compliance with export restrictions was
       detected; for example, attempting to transfer a 1024 bit
       ephemeral RSA key for the RSA_EXPORT handshake method. This
       message is always fatal.

   protocol_version
       The protocol version the client has attempted to negotiate is
       recognized, but not supported. (For example, old protocol
       versions might be avoided for security reasons). This message is
       always fatal.

   insufficient_security
       Returned instead of handshake_failure when a negotiation has
       failed specifically because the server requires ciphers more
       secure than those supported by the client. This message is always
       fatal.

   internal_error
       An internal error unrelated to the peer or the correctness of the
       protocol makes it impossible to continue (such as a memory
       allocation failure). This message is always fatal.

   user_canceled
       This handshake is being canceled for some reason unrelated to a
       protocol failure. If the user cancels an operation after the
       handshake is complete, just closing the connection by sending a
       close_notify is more appropriate. This alert should be followed
       by a close_notify. This message is generally a warning.

   no_renegotiation
       Sent by the client in response to a hello request or by the
       server in response to a client hello after initial handshaking.
       Either of these would normally lead to renegotiation; when that
       is not appropriate, the recipient should respond with this alert;
       at that point, the original requester can decide whether to
       proceed with the connection. One case where this would be
       appropriate would be where a server has spawned a process to
       satisfy a request; the process might receive security parameters
       (key length, authentication, etc.) at startup and it might be
       difficult to communicate changes to these parameters after that
       point. This message is always a warning.

   For all errors where an alert level is not explicitly specified, the
   sending party may determine at its discretion whether this is a fatal
   error or not; if an alert with a level of warning is received, the
   receiving party may decide at its discretion whether to treat this as
   a fatal error or not. However, all messages which are transmitted
   with a level of fatal must be treated as fatal messages.

document

Document Title:	SSL Error Codes as noted in the Transport Layer Security protocol, RFC 2246
Document ID:	10073421
Solution ID:	NOVL81536
Creation Date:	07Aug2002
Modified Date:	30Oct2002
Novell Product Class:	NetWare

disclaimer

The Origin of this information may be internal or external to Novell. Novell makes all reasonable efforts to verify this information. However, the information provided in this document is for your information only. Novell makes no explicit or implied claims to the validity of this information.
Any trademarks referenced in this document are the property of their respective owners. Consult your product manuals for complete trademark information.