[hybi] failed TLS handshake: which close code?

[Tobias Oberstein <[e-mail]>]

Hybi-17:

"""
4. Opening Handshake
...
4.1. Client Requirements
...
   5.  If /secure/ is true, the client MUST perform a TLS handshake over
       the connection after opening the connection and before sending
       the handshake data [RFC2818].  If this fails (e.g. the server's
       certificate could not be verified), then the client MUST _Fail
       the WebSocket Connection_ and abort the connection.  Otherwise,
       all further communication on this channel MUST run through the
       encrypted tunnel.  [RFC5246]
"""

When the client fails the TLS handshake (i.e. because of invalid server certificate),
which close status code would be appropriate to use for signaling that specific
reason to the caller?

Is it supposed to use a close status code from the following range?

"""
   3000-3999

      Status codes in the range 3000-3999 are reserved for use by
      libraries, frameworks and application.  These status codes are
      registered directly with IANA.  The interpretation of these codes
      is undefined by this protocol.
"""

Or are those only for "use on wire" not for signaling the caller?

For example, Firefox currently provides the calling JavaScript with a "1006 Abnormal Connection Close":

"""
  1006

      1006 is a reserved value and MUST NOT be set as a status code in a
      Close control frame by an endpoint.  It is designated for use in
      applications expecting a status code to indicate that the
      connection was closed abnormally, e.g. without sending or
      receiving a Close control frame.
"""

However, this could be multiple things and is not giving the real reason to the JS.
The JS thus can't react specifically ..