diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,9 @@
+## Version 1.2.4 (23 Mar 2014)
+
+- Fixed unrecognized name non-fatal alert after client hello.
+- Add SSL3 to the supported list of version by default.
+- Fix cereal lower bound to 0.4.0 minimum
+
 ## Version 1.2.3 (22 Mar 2014)
 
 - Fixed handshake records not being able to span multiples records.
diff --git a/Network/TLS/Handshake/Client.hs b/Network/TLS/Handshake/Client.hs
--- a/Network/TLS/Handshake/Client.hs
+++ b/Network/TLS/Handshake/Client.hs
@@ -103,7 +103,19 @@
                 -- client didn't offer. do nothing.
                 (Nothing, _) -> return ()
 
-        recvServerHello sentExts = runRecvState ctx (RecvStateHandshake $ onServerHello ctx cparams sentExts)
+        recvServerHello sentExts = runRecvState ctx recvState
+          where recvState = RecvStateNext $ \p ->
+                    case p of
+                        Handshake hs -> onRecvStateHandshake ctx (RecvStateHandshake $ onServerHello ctx cparams sentExts) hs
+                        Alert a      ->
+                            case a of
+                                [(AlertLevel_Warning, UnrecognizedName)] ->
+                                    if clientUseServerNameIndication cparams
+                                        then return recvState
+                                        else throwAlert a
+                                _ -> throwAlert a
+                        _ -> fail ("unexepected type received. expecting handshake and got: " ++ show p)
+                throwAlert a = usingState_ ctx $ throwError $ Error_Protocol ("expecting server hello, got alert : " ++ show a, True, HandshakeFailure)
 
 -- | send client Data after receiving all server data (hello/certificates/key).
 --
diff --git a/Network/TLS/Handshake/Common.hs b/Network/TLS/Handshake/Common.hs
--- a/Network/TLS/Handshake/Common.hs
+++ b/Network/TLS/Handshake/Common.hs
@@ -12,6 +12,7 @@
     , RecvState(..)
     , runRecvState
     , recvPacketHandshake
+    , onRecvStateHandshake
     ) where
 
 import Control.Concurrent.MVar
@@ -98,18 +99,19 @@
         Right x             -> fail ("unexpected type received. expecting handshake and got: " ++ show x)
         Left err            -> throwCore err
 
+-- | process a list of handshakes message in the recv state machine.
+onRecvStateHandshake :: Context -> RecvState IO -> [Handshake] -> IO (RecvState IO)
+onRecvStateHandshake _   recvState [] = return recvState
+onRecvStateHandshake ctx (RecvStateHandshake f) (x:xs) = do
+    nstate <- f x
+    processHandshake ctx x
+    onRecvStateHandshake ctx nstate xs
+onRecvStateHandshake _ _ _   = unexpected "spurious handshake" Nothing
+
 runRecvState :: Context -> RecvState IO -> IO ()
 runRecvState _   (RecvStateDone)   = return ()
 runRecvState ctx (RecvStateNext f) = recvPacket ctx >>= either throwCore f >>= runRecvState ctx
-runRecvState ctx iniState          = recvPacketHandshake ctx >>= loop iniState >>= runRecvState ctx
-  where
-        loop :: RecvState IO -> [Handshake] -> IO (RecvState IO)
-        loop recvState []                  = return recvState
-        loop (RecvStateHandshake f) (x:xs) = do
-            nstate <- f x
-            processHandshake ctx x
-            loop nstate xs
-        loop _                         _   = unexpected "spurious handshake" Nothing
+runRecvState ctx iniState          = recvPacketHandshake ctx >>= onRecvStateHandshake ctx iniState >>= runRecvState ctx
 
 getSessionData :: Context -> IO (Maybe SessionData)
 getSessionData ctx = do
diff --git a/Network/TLS/Handshake/Server.hs b/Network/TLS/Handshake/Server.hs
--- a/Network/TLS/Handshake/Server.hs
+++ b/Network/TLS/Handshake/Server.hs
@@ -288,6 +288,8 @@
 
         processClientCertificate p = processClientKeyExchange p
 
+        -- cannot use RecvStateHandshake, as the next message could be a ChangeCipher,
+        -- so we must process any packet, and in case of handshake call processHandshake manually.
         processClientKeyExchange (ClientKeyXchg _) = return $ RecvStateNext processCertificateVerify
         processClientKeyExchange p                 = unexpected (show p) (Just "client key exchange")
 
diff --git a/Network/TLS/Parameters.hs b/Network/TLS/Parameters.hs
--- a/Network/TLS/Parameters.hs
+++ b/Network/TLS/Parameters.hs
@@ -126,7 +126,7 @@
 
 defaultSupported :: Supported
 defaultSupported = Supported
-    { supportedVersions       = [TLS10,TLS11,TLS12]
+    { supportedVersions       = [TLS12,TLS11,TLS10,SSL3]
     , supportedCiphers        = []
     , supportedCompressions   = [nullCompression]
     , supportedHashSignatures = [ (Struct.HashSHA512, SignatureRSA)
diff --git a/tls.cabal b/tls.cabal
--- a/tls.cabal
+++ b/tls.cabal
@@ -1,5 +1,5 @@
 Name:                tls
-Version:             1.2.3
+Version:             1.2.4
 Description:
    Native Haskell TLS and SSL protocol implementation for server and client.
    .
@@ -34,7 +34,7 @@
 Library
   Build-Depends:     base >= 3 && < 5
                    , mtl
-                   , cereal >= 0.3
+                   , cereal >= 0.4
                    , bytestring
                    , byteable
                    , network