unexpected_message
unexpected_message (10) is sent when a TLS record is received that is inappropriate for the current state of the connection – a message that should not have been sent at this point in the handshake or session. This is always fatal. It indicates a protocol state machine violation.
Alert Code
10
Level
Fatal
Standard
RFC 8446
Description
unexpected_message fires when the TLS state machine receives a record type it did not expect. For example: receiving application data before the handshake is complete, receiving a second ClientHello after handshake completion, or receiving a renegotiation request in TLS 1.3 (renegotiation was removed). The alert is always fatal – the connection is immediately terminated. This typically indicates a bug in one side's TLS implementation or an active protocol-level attack.
Common Causes
- –Application data sent before handshake completion
- –Second ClientHello received after handshake (TLS state machine violation)
- –Renegotiation attempted on a TLS 1.3 connection (not supported)
- –Records received out of order due to implementation bug