protocol_version
protocol_version (70) is sent when the TLS version proposed by the client is not supported by the server. The server recognizes the protocol but does not support the version the client requested. In TLS 1.3, this is sent when a ClientHello only offers TLS versions older than what the server requires.
Alert Code
70
Level
Fatal
Standard
RFC 8446
Description
protocol_version fires when there is no overlapping TLS version between client and server. A TLS 1.3-only server that receives a ClientHello with supported_versions containing only TLS 1.0, 1.1, and 1.2 will send protocol_version. TLS 1.0 and 1.1 were deprecated by RFC 8996 in 2021 – major browsers removed support. A server sending protocol_version to an old client is behaving correctly. Clients receiving protocol_version from a server they previously connected to may indicate the server upgraded its minimum TLS version.
Common Causes
- –Client only supports TLS 1.0/1.1 which the server has disabled
- –Server requires TLS 1.3 but client only offers TLS 1.2
- –Legacy client connecting to a hardened server
- –Network middlebox intercepting and modifying ClientHello version field