unsupported_certificate
unsupported_certificate (43) is sent when the certificate type is not supported by the receiver. The certificate was parsed successfully but uses a key type, algorithm, or format the peer cannot handle – for example, a DSA certificate presented to a TLS 1.3 client, or an unsupported extension critical flag set.
Alert Code
43
Level
Fatal
Standard
RFC 8446
Description
unsupported_certificate is less common than bad_certificate but appears when deploying newer certificate types to older clients. TLS 1.3 removed DSA certificate support entirely. Ed25519 certificates may trigger this on older OpenSSL versions. A certificate with a critical extension that the client cannot process must also result in unsupported_certificate per RFC 5280. Diagnostic: verify which certificate types the peer supports via its CertificateRequest message.
Common Causes
- –DSA certificate presented to TLS 1.3 client (DSA removed in TLS 1.3)
- –Ed25519 or Ed448 certificate on older TLS implementations
- –Critical certificate extension the peer cannot process
- –Certificate format not recognized by the receiver