AdguardTeam/AdGuardHome · error

override_tls_ciphers: %w

Error message

override_tls_ciphers: %w

What it means

Validation of the tls.override_tls_ciphers config field failed: aghtls.ParseCiphers could not map the configured cipher suite names/IDs to real TLS ciphers.

Source

Thrown at internal/home/config.go:936

	}

	err = maybe.WriteFile(confPath, buf.Bytes(), aghos.DefaultPermFile)
	if err != nil {
		return fmt.Errorf("writing config file: %w", err)
	}

	return nil
}

// validateTLSCipherIDs validates the custom TLS cipher suite IDs.
func validateTLSCipherIDs(cipherIDs []string) (err error) {
	if len(cipherIDs) == 0 {
		return nil
	}

	_, err = aghtls.ParseCiphers(cipherIDs)
	if err != nil {
		return fmt.Errorf("override_tls_ciphers: %w", err)
	}

	return nil
}

// defaultConfigModifier is a default [agh.ConfigModifier] implementation.
type defaultConfigModifier struct {
	auth     *auth
	config   *configuration
	logger   *slog.Logger
	tlsMgr   aghtls.Manager
	workDir  string
	confPath string
}

// newDefaultConfigModifier returns the new properly initialized
// *defaultConfigModifier.  All arguments must not be nil.
//

View on GitHub (pinned to b41aefbe51)

Solutions

1. Remove or correct entries in tls.override_tls_ciphers to use cipher names supported by Go's crypto/tls
2. Consult Go's crypto/tls documentation for valid cipher suite names in your build
3. Drop the override entirely to use sane defaults unless specifically required

Example fix

# before
cipher_ids: [TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256_X]
# after
cipher_ids: [TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]

// Validate against Go's supported suites before applying
for _, id := range cipherIDs {
    if tls.CipherSuiteByName(id) == nil { return fmt.Errorf("unknown cipher %q", id) }
}

// Drop override and retry with defaults
if isCipherErr(err) { cfg.TLS.CipherIDs = nil; reapply() }

When it happens

Trigger: Config containing tls.cipher_ids with unknown or unsupported cipher names/IDs for the Go crypto/tls version in use.

Common situations: Copying cipher lists from OpenSSL/nginx configs with different naming (e.g. ECDHE-RSA vs Go names), removed/deprecated ciphers, typos, or ciphers unavailable in newer Go releases.

Related errors

• validating tcp ports: %w
• networksetup failed to set dns servers: %w
• found no dns servers in %s
• writing conf: %w
• invalid pattern %q: %w

AI-assisted analysis of AdguardTeam/AdGuardHome@b41aefbe51 (2026-08-27). Data as JSON: /api/errors/8381184a614b2bf0. Report an issue: GitHub.