From 81b66c9cd8eb2c76dfa571f31ad610cdf43fe2a8 Mon Sep 17 00:00:00 2001
From: Jeremiah Mackey <jeremiahmackey91@gmail.com>
Date: Mon, 4 May 2026 04:13:49 +0000
Subject: [PATCH] harden SSL config defaults

---
 src/ssl.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/ssl.c b/src/ssl.c
index bc7e6074c8..9b79027f91 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -17545,7 +17545,10 @@ int wolfSSL_set_alpn_protos(WOLFSSL* ssl,
     unsigned int ptIdx;
     unsigned int sz;
     unsigned int idx = 0;
-    int alpn_opt = WOLFSSL_ALPN_CONTINUE_ON_MISMATCH;
+    /* RFC 7301: a server that does not select any of the client's offered
+     * protocols MUST send no_application_protocol. Match that contract on
+     * the OpenSSL-compat surface rather than silently continuing. */
+    int alpn_opt = WOLFSSL_ALPN_FAILED_ON_MISMATCH;
     int ret;
 
     WOLFSSL_ENTER("wolfSSL_set_alpn_protos");