Alert to use is now defined in spec: update code
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index 6678926..c467034 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -971,8 +971,7 @@
if (!renegotiate_seen && s->new_session &&
!(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
{
- /* FIXME: Spec currently doesn't give alert to use */
- *al = SSL_AD_ILLEGAL_PARAMETER;
+ *al = SSL_AD_HANDSHAKE_FAILURE;
SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
return 0;
@@ -1161,8 +1160,7 @@
(s->new_session || !(s->options & SSL_OP_LEGACY_SERVER_CONNECT))
&& !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
{
- /* FIXME: Spec currently doesn't give alert to use */
- *al = SSL_AD_ILLEGAL_PARAMETER;
+ *al = SSL_AD_HANDSHAKE_FAILURE;
SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
return 0;
