SSL Content-type: Alert (21)

[cisco_lite]

Hi,

During https connection after the handshake is successfully done, I am getting 'Encrypted Alert' message in Wireshark/Ethereal on one of the webpages. The alert error code is 21.

Does anyone know what Alert 21 means. Or is there any list for alert protocol error codes and its description.

[robertson.michael]

Hi,

It looks like alert code 21 means that the message could not be unencrypted:

http://en.wikipedia.org/wiki/Secure_Sockets_Layer#Alert_protocol

I've never experienced this problem, so I'm not sure how to proceed in troubleshooting it. Could the packets be corrupted during transportation?

Also, you mentioned "one of the webpages". Does this mean that you are only having this error when visiting a single page and all other pages are working? If so, you may want to look at the application side of things on the web server.

Hope that helps.

-Mike

[Prab]

In a nutshell TLS is all about different records. Different records serve different purposes. Records have Content-Type field and Message fields (Some other fields too).

Content-Type will state Record Layer Protocol Type. Depending upon the Content-Type field's value, you know what is the purpose of a particular record. For eg: Content-Type=21 means that this is an Alert protocol and Content-Type=22 means that this is a Handshake protocol. 

Message field will contain the actual message related to a particular Record Protocol type.

The Alert protocol further has a field called Description. This field contains the actual error information.

There are different Descriptions, the list could be found here: https://tools.ietf.org/html/rfc5246#page-29 

Each Description has a Code associated with it. A Description named decryption_failed_RESERVED has Code of 21.

Now coming to the wireshark:

The 21 shown in the wireshark capture is not a code but it is value in the Content-Type field of the TLS record. In plain words, the wireshark is telling us that this is a TLS Alert protocol. 

The Message field  is encrypted. The wireshark is not able to look further into this Message field as it is encrypted. So, wireshark doesn't show the actual Message.

Alert_Protocol

There is a possibility to decrypt the captures in wireshark. https://wiki.wireshark.org/SSL 

Hope this helps.

Prab :)