I am having an issue with Windows IIS server and TLS 1.2 handshake. Windows sent Encrypted Handshake Message and the Client sent Encrypted Alert then both sides reset the connection as shown in the picture. I'd like to understand what causes the Encrypted Alert as more data is expected to be sent. Please help :)

enter image description here

  • Does the server require a client certificate? – Esa Jokinen Jun 7 '20 at 6:22
  • Hi Esa - No, the server does not require client certificate. – SissiB Jun 7 '20 at 6:33
  • As handshake packets look good, you should move on to decrypt the following conversation, support.citrix.com/article/CTX116557 That will reveal what closed the connection. – Lex Li Jun 7 '20 at 15:16

The packet capture clearly shows application data from client to server, which means that the initial handshake itself was already successfully done.

The server reacts to the application data with an Encrypted Handshake message. This might be caused by a request in the application data which requires authentication by client certificate, i.e. no global client certificate to access the server but only one for specific path. The following Encrypted Alert might indicate the TLS Shutdown of the client which closes the connection since it does not possess the requested certificate.

That's likely about all you might get as information from the packet capture alone. For more one would need to have a closer lookup at the server and client side setup, application requirements and log messages.

  • Many thanks @Steffen! That was very helpful :) – SissiB Jun 12 '20 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.