diff --git a/transport/internet/tls/config.go b/transport/internet/tls/config.go
index c5bd6c37..daca8f16 100644
--- a/transport/internet/tls/config.go
+++ b/transport/internet/tls/config.go
@@ -235,7 +235,7 @@ func getNewGetCertificateFunc(certs []*tls.Certificate, rejectUnknownSNI bool) f
 			}
 		}
 		if rejectUnknownSNI {
-			return nil, newError("reject unknown sni")
+			return nil, errNoCertificates
 		}
 		return certs[0], nil
 	}
diff --git a/transport/internet/tls/unsafe.go b/transport/internet/tls/unsafe.go
new file mode 100644
index 00000000..bb212abd
--- /dev/null
+++ b/transport/internet/tls/unsafe.go
@@ -0,0 +1,6 @@
+package tls
+
+import _ "unsafe"
+
+//go:linkname errNoCertificates crypto/tls.errNoCertificates
+var errNoCertificates error
diff --git a/transport/internet/xtls/config.go b/transport/internet/xtls/config.go
index 58faa7f0..b74976cb 100644
--- a/transport/internet/xtls/config.go
+++ b/transport/internet/xtls/config.go
@@ -236,7 +236,7 @@ func getNewGetCertificateFunc(certs []*xtls.Certificate, rejectUnknownSNI bool)
 			}
 		}
 		if rejectUnknownSNI {
-			return nil, newError("reject unknown sni")
+			return nil, errNoCertificates
 		}
 		return certs[0], nil
 	}
diff --git a/transport/internet/xtls/unsafe.go b/transport/internet/xtls/unsafe.go
new file mode 100644
index 00000000..181684e8
--- /dev/null
+++ b/transport/internet/xtls/unsafe.go
@@ -0,0 +1,6 @@
+package xtls
+
+import _ "unsafe"
+
+//go:linkname errNoCertificates crypto/tls.errNoCertificates
+var errNoCertificates error