INADEQUATE_SECURITY
INADEQUATE_SECURITY (0xc) is sent when the TLS security parameters of the connection do not meet the minimum requirements for HTTP/2. RFC 9113 Appendix A defines requirements: TLS 1.2 minimum, no TLS compression, no renegotiation, specific forbidden cipher suites. Connections that fail these requirements receive INADEQUATE_SECURITY.
Code
0xc
Decimal
12
Standard
RFC 9113 §7
Description
HTTP/2 over TLS has stricter security requirements than HTTP/1.1. RFC 9113 Appendix A lists cipher suites with NULL, Export, ANON, RC4, or 3DES components as prohibited. TLS 1.0 and TLS 1.1 are prohibited. TLS compression must be disabled. If a client connects using TLS 1.2 with an inadequate cipher suite (like TLS_RSA_WITH_AES_128_CBC_SHA, which lacks forward secrecy), the server may send INADEQUATE_SECURITY and the client should retry with better TLS parameters. Practically, modern TLS configurations using TLS 1.3 or TLS 1.2 with ECDHE+AEAD suites will never trigger this.
Common Causes
- –TLS 1.0 or TLS 1.1 used (prohibited for HTTP/2)
- –Cipher suite without forward secrecy (static RSA key exchange)
- –Prohibited cipher suite (RC4, 3DES, NULL, EXPORT)
- –TLS compression enabled (prohibited for HTTP/2)