illegal_parameter
illegal_parameter (47) is sent when a field in the TLS handshake is out of range or inconsistent with other fields. The value was syntactically parseable but semantically invalid – a cipher suite not listed in the ClientHello selected in ServerHello, or a named group not offered by the client being selected by the server.
Alert Code
47
Level
Fatal
Standard
RFC 8446
Description
illegal_parameter is sent when handshake consistency checks fail. RFC 8446 specifies strict rules: the server must only select cipher suites and extensions the client offered. If the server selects TLS_AES_128_GCM_SHA256 but the client did not include it in its ClientHello, the client sends illegal_parameter. This is always a server-side implementation bug – a standards-compliant server will never trigger this. Also triggered by invalid key_share values or extensions with semantically invalid values.
Common Causes
- –Server selected a cipher suite not offered by the client
- –Server selected a named group (curve) not offered by the client
- –ServerHello contains an extension not in the ClientHello
- –key_share value outside the allowed range for the selected group