Day 17: Alert Protocol and Error Handling

Phase 1 · May 30, 2026

Agenda (2–3 hours)

• Read (45 min): RFC 8446 §6 (Alert Protocol), Appendix B.2 (Alert messages list)
• Study (45 min): Alert taxonomy, connection teardown, common failure modes
• Practice (60 min): Trigger 3 specific alert types deliberately
• Challenge (30 min): Diagnose and document each failure

Alert Protocol Structure

struct {
    AlertLevel level;        // warning(1) or fatal(2)
    AlertDescription desc;   // specific error code
} Alert;

In TLS 1.3, all alerts that cause connection termination are fatal in practice.
The level field is kept for backward compatibility only — ignore it for semantic meaning.

After a fatal alert, the connection must be torn down. No data may be sent after a fatal alert.

Common Alert Descriptions

Connection Teardown

Clean close:

→ Alert(close_notify)   // "I'm done sending"
← Alert(close_notify)   // "acknowledged"

Both sides send close_notify before closing the TCP connection.
This prevents truncation attacks (attacker closes TCP to cut off data).

Abrupt close (error):

→ Alert(fatal, <error>)
  [TCP close, no response expected]

Practice Exercise

Deliberately trigger each of these alerts and capture the exact error:

# 1. certificate_expired: connect to a server with an expired cert
openssl s_client -connect expired.badssl.com:443 2>&1 | grep -E "alert|verify"

# 2. unknown_ca: present cert from untrusted CA
openssl s_client -connect self-signed.badssl.com:443 2>&1 | grep -E "alert|verify"

# 3. wrong_cert: present wrong cert for SNI
openssl s_client -connect wrong.host.badssl.com:443 2>&1 | grep -E "alert|verify"

# 4. Force handshake_failure: no overlapping cipher suites
openssl s_client -connect google.com:443 -cipher NULL 2>&1 | grep -E "alert|error"

badssl.com provides intentionally broken TLS configurations for testing.

Challenge Assignment

Create a TLS alert reference card in Markdown covering these 8 scenarios:

Fill in every column from RFC 8446 Appendix B.2 and your lab results.

Resources

• RFC 8446 §6: Alert Protocol
• RFC 8446 Appendix B.2: Alert messages
• badssl.com: intentionally broken TLS endpoints for testing