Mutual Authentication (mTLS) outbound call fails with "SSLException: Tag mismatch!"Issue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Outbound integration calls (REST/SOAP), including those using certificate-based mutual authentication (mTLS), fail. The instance log / Outbound HTTP Log shows WARNING *** WARNING *** javax.net.ssl.SSLException: Tag mismatch!: Tag mismatch! A parallel openssl s_client test against the same endpoint reports: ...:tls_get_more_records:decryption failed or bad record mac ...:record layer failure Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } All releases Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Tag mismatch! is a TLS record-layer (AES-GCM) decryption failure. It occurs after the TLS handshake has already completed successfully, when the authentication tag on an encrypted record fails to validate. This is not a certificate, certificate-chain, keystore, trust, or ServiceNow configuration problem. Certificate/chain problems fail earlier - during the handshake with errors such as SSLHandshakeException or PKIX path building failed … unable to find valid certification path (see KB2794513). Because Tag mismatch! happens at the record layer, the cause is corruption or rewriting of the encrypted record stream in the network path, or a TLS version/cipher incompatibility, typically: A TLS-inspecting middlebox (forward/reverse proxy, firewall SSL inspection, or load balancer) that mishandles TLS 1.3 record sequencing.A remote endpoint whose own TLS 1.3 implementation or ingress appliance is faulty.Less commonly, MTU/fragmentation issues along the path. There is no product defect associated with this signature. Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Step 1 - Confirm it is a record-layer failure (not a certificate failure): From a host on the customer network, run: openssl s_client -connect <hostname>:443 -servername <hostname> -showcertsIf the output shows the handshake completing: SSL handshake has read … bytes and written … bytes New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256 followed by decryption failed or bad record mac / record layer failure, then the handshake succeeded and the failure is purely at the record layer. This confirms the cause is the transport path, not certificates. Note that this reproduces with no client certificate involved (No client certificate CA names sent) and without ServiceNow, which conclusively rules out the instance's keystore / mutual-auth configuration as the cause. Step 2 - Isolate the TLS version: openssl s_client -connect <hostname>:443 -servername <hostname> -tls1_2 TLS 1.2 succeeds, TLS 1.3 fails - a middlebox or the remote endpoint cannot correctly handle TLS 1.3. (Most common outcome.)TLS 1.2 also fails - deeper transport fault (broadly broken middlebox, or MTU/fragmentation). Step 3 — Fix the offending hop: If a customer-side proxy/firewall performs SSL inspection, allowlist / bypass the target endpoint, or upgrade the appliance to properly support TLS 1.3.If the failure is on the destination side, escalate to the third-party endpoint owner to correct their TLS 1.3 handling or ingress appliance.Stopgap only: while the path is being fixed, the outbound connection can be constrained to TLS 1.2 for that endpoint. Prefer the permanent network fix. Tip: If the identical Tag mismatch reproduces from two independent client paths (e.g., the ServiceNow instance and a separate customer workstation), the common factor is the destination side - focus on the remote endpoint's TLS implementation / ingress, not the customer's local proxy. Additional Information Quick exclusions (verify once, then move on; these are not the cause of this signature): Legacy outbound-SSL system properties: Check sys_properties for glide.httpclient.protocol.*. If present, remove them and configure mutual authentication via a Protocol Profile (KB0696002).Client keystore: Open the Protocol Profile's Key Store (sys_certificate); confirm Type = PKCS12/JKS, Active, correct password, and that Validate Stores/Certificates returns Valid. Known red herring: An openssl verify error:num=20: unable to get local issuer certificate (or Verify return code: 20) usually only means the machine running openssl lacks the server's intermediate/root CA in its local trust store, it does not cause Tag mismatch! and is unrelated to whether ServiceNow can connect. Related Links<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } KB0696002 - Outbound Mutual Authentication setupKB2794513 - Certificate Based Mutual Authentication (mTLS) is failing with error (handshake/certificate-layer failures)