What are the Schannel TLS fatal alert codes?

JD Brennan picture JD Brennan · Jun 26, 2020 · Viewed 26.3k times · Source

Where can I find a definition of the Windows Schannel fatal alerts codes that show up in Event Viewer? For instance:

  • A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 40.
  • A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 70. The Windows SChannel error state is 105.

Answer

JD Brennan picture JD Brennan · Jun 26, 2020

The alert codes are defined at:

https://docs.microsoft.com/en-us/windows/win32/secauthn/schannel-error-codes-for-tls-and-ssl-alerts

    40 = SSL3_ALERT_HANDSHAKE_FAILURE
    42 = TLS1_ALERT_BAD_CERTIFICATE
    43 = TLS1_ALERT_UNSUPPORTED_CERT
    44 = TLS1_ALERT_CERTIFICATE_REVOKED
    45 = TLS1_ALERT_CERTIFICATE_EXPIRED
    46 = TLS1_ALERT_CERTIFICATE_UNKNOWN
    48 = TLS1_ALERT_UNKNOWN_CA
    70 = TLS1_ALERT_PROTOCOL_VERSION