insufficient_security
insufficient_security (71) is sent when the server requires security parameters stronger than those offered by the client. Unlike handshake_failure (which means no overlap), insufficient_security means the client offered cipher suites and parameters that the server considers too weak to accept.
Alert Code
71
Level
Fatal
Standard
RFC 8446
Description
insufficient_security is the security-policy version of handshake_failure. The server has a minimum security policy – for example, requiring a minimum DHE group size of 2048 bits or disallowing cipher suites below a certain strength – and the client's offerings all fall below that threshold. This is used when the server can enumerate cipher suites offered by the client but considers them all inadequate. The distinction from handshake_failure: insufficient_security means the client tried but offered weak options; handshake_failure means there was no overlap at all.
Common Causes
- –Client only offered DHE groups smaller than server's minimum (e.g., 1024-bit)
- –Client only offered cipher suites below the server's security policy threshold
- –All client cipher suites are on the server's weak/deprecated list