AWS_IO_TLS_ERROR_NEGOTIATION_FAILURE on Win2012 (non-R2) Datacenter

[gh-dmitri-o]

Describe the bug

The release (0.27.4) and Python 3.11.9 is failing on Windows 2012 (non-R2). No TLS connectivity. It was working with awscrt==0.16.10 and Python 3.8. However, works on Windows 10.

It seems the code is incorrectly detecting the Windows version. The code checks Windows version using VerifyVersionInfo() against _WIN32_WINNT_WIN8 (0x602) and reports that the version is >=8.1. The correct verification would be to check against _WIN32_WINNT_WINBLUE (0x603).
Is Windows 2012 (non-R2) supported?

---

[DEBUG] [2025-10-23T04:48:41Z] [00000344] [tls-handler] - static: This library was built with Windows 8.1 or later, probing OS to see what we're actually running on.
[DEBUG] [2025-10-23T04:48:41Z] [00000344] [tls-handler] - static: We're running on Windows 8.1 or later. ALPN is available.
[TRACE] [2025-10-23T04:48:41Z] [00000344] [tls-handler] - id=0000001F1ADBF080: Retrieving negotiated protocol.
[WARN] [2025-10-23T04:48:41Z] [00000344] [tls-handler] - id=0000001F1ADBF080: Error retrieving negotiated protocol. SECURITY_STATUS is -2146893054
[DEBUG] [2025-10-23T04:48:41Z] [00000344] [channel-bootstrap] - id=0000001F177C28C0: tls negotiation result 1029 on channel 0000001F19DFC2B0
[TRACE] [2025-10-23T04:48:41Z] [00000344] [channel] - id=0000001F19DFC2B0: channel shutdown task is scheduled
[TRACE] [2025-10-23T04:48:41Z] [00000344] [channel] - id=0000001F19DFC2B0: scheduling task with wrapper task id 0000001F19DFC490.
[TRACE] [2025-10-23T04:48:41Z] [00000344] [event-loop] - id=0000001F1AD59920: scheduling channel_shutdown task 0000001F19DFC490 in-thread for timestamp 0
[TRACE] [2025-10-23T04:48:41Z] [00000344] [task-scheduler] - id=0000001F19DFC490: Scheduling channel_shutdown task for immediate execution
[DEBUG] [2025-10-23T04:48:41Z] [00000344] [channel] - id=0000001F19DFC2B0: Channel shutdown is already pending, not scheduling another.
[TRACE] [2025-10-23T04:48:41Z] [00000344] [socket-handler] - id=0000001F1ADAE440: total read on this tick 91
[DEBUG] [2025-10-23T04:48:41Z] [00000344] [channel] - id=0000001F19DFC2B0: Channel shutdown is already pending, not scheduling another.
[TRACE] [2025-10-23T04:48:41Z] [00000344] [event-loop] - id=0000001F1AD59920: running scheduled tasks.
[TRACE] [2025-10-23T04:48:41Z] [00000344] [task-scheduler] - id=0000001F19DFC490: Running channel_shutdown task with status
[DEBUG] [2025-10-23T04:48:41Z] [00000344] [channel] - id=0000001F19DFC2B0: beginning shutdown process
[TRACE] [2025-10-23T04:48:41Z] [00000344] [channel] - id=0000001F19DFC2B0: shutting down slot 0000001F1AD91210 (the first one) in the read direction
[TRACE] [2025-10-23T04:48:41Z] [00000344] [channel] - id=0000001F19DFC2B0: shutting down slot 0000001F1AD91210, with handler 0000001F1ADAE440 in read direction with error code 1029 : AWS_IO_TLS_ERROR_NEGOTIATION_FAILURE
[TRACE] [2025-10-23T04:48:41Z] [00000344] [socket-handler] - id=0000001F1ADAE440: shutting down read direction with error_code 1029 : AWS_IO_TLS_ERROR_NEGOTIATION_FAILURE
[DEBUG] [2025-10-23T04:48:41Z] [00000344] [channel] - id=0000001F19DFC2B0: handler 0000001F1ADAE440 shutdown in read dir completed.
[DEBUG] [2025-10-23T04:48:41Z] [00000344] [tls-handler] - id=0000001F1ADBF080: shutting down read direction with error 1029.

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

TLS 1.2 connection to the AWS is expected to work on Win2012.

Current Behavior

The error AWS_IO_TLS_ERROR_NEGOTIATION_FAILURE is reported on Win2012 for any connectivity to AWS using Python 3.11.9.

Reproduction Steps

Install Windows 2012 (non-R2).
Install Python 3.11.9.
Install awsiotsdk==1.26.0.
Run mqtt_test.py that is already in the repo.
Observe the errors.

Possible Solution

No response

Additional Information/Context

No response

aws-crt-python version used

0.27.4

Python version used

3.11.9

Operating System and version

Windows 2012 Datacenter (6.2.9200 Build 9200)

[sfod]

crt v0.16.10 worked for you probably because of a bug where the alpn-related errors were basically ignored (aws_raise_error just sets some variable). We fixed it, so now it looks like this.

As for the fix. We've encountered issues with _WIN32_WINNT_WINBLUE in the past, so had to revert back to _WIN32_WINNT_WIN8. The right approach would be to check for the availability of the feature, but we don't have access to Windows 2012 to implement the fix.

You can try to use port 8883 if your firewall allows that. SDKs set alpn when port is 443 (see mqtt5 builder or mqtt311 builder).
I verified, with 8883 there were no alpn in TLS handshake.