EC
ERR_TLS_RENEGOTIATION_FAILED
Node.jsERRORNotableTLSHIGH confidence

TLS renegotiation request failed

Production Risk

Security-sensitive — renegotiation failure for client auth must be handled by terminating the connection.

What this means

Thrown when a TLS renegotiation attempt initiated by tlsSocket.renegotiate() fails. The failure may be due to the peer refusing the renegotiation, network interruption, or TLS protocol errors during the renegotiation handshake.

Why it happens
  1. 1The remote peer refused or did not respond to the renegotiation
  2. 2Network error interrupted the renegotiation handshake
  3. 3The socket was destroyed before renegotiation could complete
How to reproduce

Triggered when the renegotiation callback receives an error from the TLS handshake.

trigger — this will error
trigger — this will error
const tls = require('tls');
const socket = tls.connect({ host: 'example.com', port: 443 }, () => {
  socket.renegotiate({ rejectUnauthorized: true }, (err) => {
    if (err) console.error(err.code); // ERR_TLS_RENEGOTIATION_FAILED
  });
});

expected output

Error [ERR_TLS_RENEGOTIATION_FAILED]: Failed to renegotiate

Fix 1

Establish a new TLS connection instead of renegotiating

WHEN When you need updated TLS parameters

Establish a new TLS connection instead of renegotiating
// Close the current socket and open a new one with updated options
socket.destroy();
const newSocket = tls.connect({ host: 'example.com', port: 443, /* new options */ });

Why this works

A fresh TLS connection avoids renegotiation entirely and is more reliable.

Fix 2

Handle renegotiation failure gracefully in the callback

WHEN When renegotiation is used for client certificate verification

Handle renegotiation failure gracefully in the callback
socket.renegotiate({ requestCert: true }, (err) => {
  if (err) {
    socket.destroy(new Error('Client auth failed'));
    return;
  }
  // proceed with authenticated socket
});

Why this works

Destroying the socket on failure prevents unauthenticated access.

Code examples
Triggerjs
const tls = require('tls');
const socket = tls.connect({ host: 'example.com', port: 443 }, () => {
  socket.renegotiate({ rejectUnauthorized: true }, (err) => {
    if (err) console.error(err.code); // ERR_TLS_RENEGOTIATION_FAILED
  });
});  // this triggers ERR_TLS_RENEGOTIATION_FAILED
Handle in try/catchjs
try {
  // operation that may throw ERR_TLS_RENEGOTIATION_FAILED
  riskyOperation()
} catch (err) {
  if (err.code === 'ERR_TLS_RENEGOTIATION_FAILED') {
    console.error('ERR_TLS_RENEGOTIATION_FAILED:', err.message)
  } else {
    throw err
  }
}
Defensive pattern to avoid itjs
// Validate inputs before calling the operation
function safe_err_tls_renegotiation_failed(...args) {
  // validate args here
  return performOperation(...args)
}
What not to do

✕ Ignore renegotiation errors and continue using the socket

A failed renegotiation may leave the session in an undefined security state.

Same error in other languages
ssl.SSLErrorin Python→
Sources
Official documentation ↗

Node.js Error Codes Documentation

Content generated with AI assistance and reviewed for accuracy. Found an error? hello@errcodes.dev

← All Node.js errors