Skip to content
Awake docs

A tunnel's TLS named another host

Code: egress.sni_mismatch

What happened

Section titled “What happened”

A tunnel’s TLS named another host than its CONNECT did, so the proxy closed it.

Awake sends no text for this: your tool prints its own error.

Why Awake does this

Section titled “Why Awake does this”

Every request a box sends leaves through the Egress Proxy, outside the box, which allows only what your org’s policy names and refuses the rest. The Egress Proxy says more.

What you can do

Section titled “What you can do”

Use the same host in the request and in its TLS, which tools do unless set to differ.

Your tool prints its own TLS error, such as a reset connection or a handshake failure, since the proxy closes the tunnel before any answer. Most tools name the same host in the request and in its TLS on their own; check for a setting that overrides the TLS name, such as a client’s server-name or SNI option, and remove it.

What your admin can do

Section titled “What your admin can do”

Nothing in the console changes this.

For agents

Section titled “For agents”

Tell the person what was refused and why, with this code, and don’t retry in a loop. Don’t try another host, encoding or route to get around a control.

Where Awake records it

Section titled “Where Awake records it”

The Egress Proxy records each refusal, never the request’s data. Org admins and security auditors read the records in the Audit log.

Section titled “Related codes”

Still stuck

Section titled “Still stuck”

Ask your Awake admin. Give them the code, egress.sni_mismatch, and when it happened.