diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data
index f7876d993e..c27c6fc622 100644
--- a/tests/suites/test_suite_ssl.data
+++ b/tests/suites/test_suite_ssl.data
@@ -3374,6 +3374,9 @@ cookie_parsing:"16fefd0000000000000000002f010000de000000000000011efefd7b72727272
 Cookie parsing: one byte overread
 cookie_parsing:"16fefd0000000000000000002F010000de000000000000011efefd7b7272727272727272727272727272727272727272727272727272727272727d0001":MBEDTLS_ERR_SSL_DECODE_ERROR
 
+TLS 1.3: duplicate extension rejected
+tls13_check_received_extension_duplicate
+
 TLS 1.3 srv Certificate msg - wrong vector lengths
 tls13_server_certificate_msg_invalid_vector_len
 
diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function
index c1cf9bab86..2d3ee94151 100644
--- a/tests/suites/test_suite_ssl.function
+++ b/tests/suites/test_suite_ssl.function
@@ -4284,6 +4284,39 @@ exit:
     MD_OR_USE_PSA_DONE();
 }
 /* END_CASE */
+
+/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3 */
+void tls13_check_received_extension_duplicate()
+{
+    int ret;
+    mbedtls_ssl_context ssl;
+    mbedtls_ssl_handshake_params *handshake = NULL;
+
+    mbedtls_ssl_init(&ssl);
+
+    handshake = mbedtls_calloc(1, sizeof(*handshake));
+    TEST_ASSERT(handshake != NULL);
+
+    ssl.handshake = handshake;
+
+    /* Simulate that SERVERNAME was already seen, then reprocess it. */
+    handshake->received_extensions = MBEDTLS_SSL_EXT_MASK(SERVERNAME);
+
+    ret = mbedtls_ssl_tls13_check_received_extension(
+        &ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
+        MBEDTLS_TLS_EXT_SERVERNAME,
+        MBEDTLS_SSL_EXT_MASK(SERVERNAME));
+    TEST_EQUAL(ret, MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
+
+exit:
+    if (handshake != NULL) {
+        mbedtls_free(handshake);
+        ssl.handshake = NULL;
+    }
+    mbedtls_ssl_free(&ssl);
+}
+/* END_CASE */
+
 /* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3:!MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ECC_SECP_R1_384 */
 void tls13_server_certificate_msg_invalid_vector_len()
 {