What causes "cannot parse `min_version`: %w" in VictoriaMetrics/VictoriaMetrics?

Use one of the accepted values: TLS10, TLS11, TLS12, TLS13 (case-insensitive per netutil.ParseTLSVersion)

cannot parse `min_version`: %w

Error message

cannot parse `min_version`: %w

What it means

Fires in tlsContext.initFromTLSConfig when tls_config.min_version cannot be parsed by netutil.ParseTLSVersion. It means the configured minimum TLS version string is not a recognized value (valid: TLS10, TLS11, TLS12, TLS13); the wrapped error explains why parsing failed.

Source

Thrown at lib/promauth/config.go:993

		tctx.tlsRootCADigest = fmt.Sprintf("digest(CA)=%d", h)
	} else if tc.CAFile != "" {
		path := fscore.GetFilepath(baseDir, tc.CAFile)
		tctx.getTLSRootCA = func() (*x509.CertPool, error) {
			data, err := fscore.ReadFileOrHTTP(path)
			if err != nil {
				return nil, fmt.Errorf("cannot read `ca_file`: %w", err)
			}
			rootCA := x509.NewCertPool()
			if !rootCA.AppendCertsFromPEM(data) {
				return nil, fmt.Errorf("cannot parse data read from `ca_file` %q", tc.CAFile)
			}
			return rootCA, nil
		}
		tctx.tlsRootCADigest = fmt.Sprintf("caFile=%q", tc.CAFile)
	}
	v, err := netutil.ParseTLSVersion(tc.MinVersion)
	if err != nil {
		return fmt.Errorf("cannot parse `min_version`: %w", err)
	}
	tctx.minVersion = v
	return nil
}

View on GitHub (pinned to 5079fb58f1)

Solutions

Use one of the accepted values: TLS10, TLS11, TLS12, TLS13 (case-insensitive per netutil.ParseTLSVersion)
Replace numeric forms like '1.2' with 'TLS12'
Check netutil.ParseTLSVersion in lib/netutil for the exact alias list supported by this version
Remove the min_version field entirely to use the Go default

Example fix

// before
min_version: TLSv1.3_with_fallback
// after
min_version: TLS13

Defensive patterns

Strategy: try-catch

Validate before calling

// pre-validate min_version against the values netutil.ParseTLSVersion accepts
allowed := map[string]bool{"tls10": true, "tls11": true, "tls12": true, "tls13": true}
if cfg.TLS.MinVersion != "" && !allowed[strings.ToLower(strings.TrimSpace(cfg.TLS.MinVersion))] {
	return fmt.Errorf("min_version %q not accepted; use TLS10/TLS11/TLS12/TLS13", cfg.TLS.MinVersion)
}

Prevention

Only use the canonical tokens TLS10-TLS13 in configs
Pin a config schema/linter (e.g. JSON schema check in CI) for TLS fields
Omit min_version unless a compliance requirement forces it
Consult netutil.ParseTLSVersion in this repo for the authoritative alias list before copying external examples

When it happens

Trigger: Setting min_version to values like 'TLSv1.2' vs accepted alias, '1.2', 'tls-1.2', lowercase/typo variants the parser does not recognize, or an empty-but-whitespace value.

Common situations: Copying config from Prometheus or curl docs whose accepted tokens differ; using 'TLS 1.3' with a space; downgrading configs between library versions where alias sets changed.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of VictoriaMetrics/VictoriaMetrics@5079fb58f1 (2026-09-03). Data as JSON: /api/errors/2e0cb09194ab7dd1. Report an issue: GitHub.