unknown_psk_identity
unknown_psk_identity (115) is sent in TLS 1.3 when a client offers a pre-shared key (PSK) identity in its ClientHello and the server does not recognize any of the offered PSK identities. If PSK is the only key establishment method configured, no session can be established.
Alert Code
115
Level
Fatal
Standard
RFC 8446
Description
TLS 1.3 supports pre-shared keys as an alternative to certificate-based authentication and for 0-RTT session resumption. The client includes a list of PSK identities (session ticket values or out-of-band shared secrets) in the pre_shared_key extension of ClientHello. If the server cannot find a match for any of them, it sends unknown_psk_identity. In session resumption contexts, this typically means the session ticket has expired or been invalidated on the server side. The client should fall back to a full TLS handshake with certificates.
Common Causes
- –Session ticket expired on the server side (TLS 1.3 0-RTT resumption failed)
- –Server restarted and lost in-memory session state
- –Out-of-band PSK identity mismatch between client and server
- –PSK-only configuration with no valid shared key available