close_notify
close_notify (0) signals that the sender will not send any more messages on this connection. It is a graceful shutdown – both sides must send close_notify before closing the TCP connection to avoid a truncation attack. TLS 1.3 changed close_notify from warning-level to a mandatory procedure.
Alert Code
0
Level
Warning
Standard
RFC 8446
Description
close_notify is the TLS equivalent of a clean TCP FIN. RFC 8446 §6.1 requires both endpoints to send close_notify before closing the connection. In TLS 1.3, failing to send close_notify before closing is treated as a potential truncation attack. The receiving side must discard any pending writes and send their own close_notify in response. HTTP/1.1 over TLS can omit close_notify if the content-length or chunked encoding makes the message boundary clear, but HTTP/2 and HTTP/3 always require it.
Common Causes
- –Clean TLS session shutdown by either side
- –Server sending close_notify during graceful restart
- –Connection idle timeout triggering clean closure
- –Client navigating away from a page with an active TLS connection