The handshake aborts because the server doesn't confirm the external PSK

The TLS adapter aborts the handshake with a counterpart and writes a log entry; no connection without the additional secret is opened.

Relationship connections in TLS 1.3 with an external PSK per RFC 9973, with the TLS adapter as the client.

The client sends the tls_cert_with_extern_psk extension in its ClientHello. The server confirms it in the ServerHello only if it accepts the offered external PSK. Without the confirmation, the TLS adapter aborts instead of silently falling back to TLS without a PSK. Typical reasons: the counterpart isn't the TLS adapter of a relationship, it doesn't know the secret, or it doesn't support the extension.

1. Check that the address points to the other side's TLS adapter and not to some other service on the same host.
2. In monitoring, check the age of the most recent secret for this agent pair; without a shared secret, the server can't accept the PSK.
3. If your relationship policy explicitly allows a fallback to TLS without a PSK, the connection is opened without the additional secret, and every such connection is logged. Without that permission, there's no fallback.

The ServerHello confirms tls_cert_with_extern_psk, and the TLS adapter's log shows no further aborts for this relationship.

• PQ key exchange for TLS – the rules from RFC 9973
• No new connections to a partner