{"record":{"id":"0d90d86bcc12d7fc","repo":"golang/go","slug":"tls-no-supported-versions-satisfy-minversion-and","errorCode":null,"errorMessage":"tls: no supported versions satisfy MinVersion and MaxVersion","messagePattern":"tls: no supported versions satisfy MinVersion and MaxVersion","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/handshake_client.go","lineNumber":64,"sourceCode":"\tif len(config.ServerName) == 0 && !config.InsecureSkipVerify {\n\t\treturn nil, nil, nil, errors.New(\"tls: either ServerName or InsecureSkipVerify must be specified in the tls.Config\")\n\t}\n\n\tnextProtosLength := 0\n\tfor _, proto := range config.NextProtos {\n\t\tif l := len(proto); l == 0 || l > 255 {\n\t\t\treturn nil, nil, nil, errors.New(\"tls: invalid NextProtos value\")\n\t\t} else {\n\t\t\tnextProtosLength += 1 + l\n\t\t}\n\t}\n\tif nextProtosLength > 0xffff {\n\t\treturn nil, nil, nil, errors.New(\"tls: NextProtos values too large\")\n\t}\n\n\tsupportedVersions := config.supportedVersions(roleClient, c.quic != nil)\n\tif len(supportedVersions) == 0 {\n\t\treturn nil, nil, nil, errors.New(\"tls: no supported versions satisfy MinVersion and MaxVersion\")\n\t}\n\t// Since supportedVersions is sorted in descending order, the first element\n\t// is the maximum version and the last element is the minimum version.\n\tmaxVersion := supportedVersions[0]\n\tminVersion := supportedVersions[len(supportedVersions)-1]\n\n\thello := &clientHelloMsg{\n\t\tvers:                         maxVersion,\n\t\tcompressionMethods:           []uint8{compressionNone},\n\t\trandom:                       make([]byte, 32),\n\t\textendedMasterSecret:         true,\n\t\tocspStapling:                 true,\n\t\tscts:                         true,\n\t\tserverName:                   hostnameInSNI(config.ServerName),\n\t\tsupportedCurves:              config.curvePreferences(maxVersion),\n\t\tsupportedPoints:              []uint8{pointFormatUncompressed},\n\t\tsecureRenegotiationSupported: true,\n\t\talpnProtocols:                config.NextProtos,","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/handshake_client.go#L46-L82","documentation":"Thrown by makeClientHello when config.supportedVersions() returns an empty slice, meaning no TLS version in the library's supported set falls within the configured [MinVersion, MaxVersion] range. This happens when MinVersion > MaxVersion, or when the range excludes all versions the library supports (TLS 1.0 through 1.3).","triggerScenarios":"Setting MinVersion higher than MaxVersion (e.g., MinVersion=VersionTLS13, MaxVersion=VersionTLS12). Setting MaxVersion to a value below all supported versions. Setting MinVersion to a value above all supported versions. Using a future or unsupported version constant.","commonSituations":"Inverting MinVersion and MaxVersion during configuration. Copying a config designed for TLS 1.2-only and upgrading MinVersion without updating MaxVersion. Programmatically computing version bounds with a comparison bug. Setting MaxVersion to VersionTLS12 while MinVersion defaults to VersionTLS13 through ECH config.","solutions":["Ensure MinVersion <= MaxVersion in the tls.Config","Verify at least one supported version (VersionTLS10 through VersionTLS13) falls within [MinVersion, MaxVersion]","Leave both MinVersion and MaxVersion as 0 (zero value) to use the library defaults if you do not need explicit version constraints","If restricting to TLS 1.3 only, set MinVersion=VersionTLS13 and leave MaxVersion=0 (or set it to VersionTLS13)"],"exampleFix":"// before — inverted range\nconfig := &tls.Config{\n    MinVersion: tls.VersionTLS13,\n    MaxVersion: tls.VersionTLS12, // lower than MinVersion → error\n}\n// after\nconfig := &tls.Config{\n    MinVersion: tls.VersionTLS12,\n    MaxVersion: tls.VersionTLS13,\n}\n// or use defaults:\nconfig := &tls.Config{} // MinVersion=0, MaxVersion=0 → library defaults","handlingStrategy":"validation","validationCode":"func validateVersionRange(config *tls.Config) error {\n    if config.MinVersion != 0 && config.MaxVersion != 0 && config.MinVersion > config.MaxVersion {\n        return fmt.Errorf(\"MinVersion (0x%04x) > MaxVersion (0x%04x)\", config.MinVersion, config.MaxVersion)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Pre-validate before dial:\n//\n//   if err := validateVersionRange(config); err != nil {\n//       config.MinVersion = 0\n//       config.MaxVersion = 0 // reset to defaults\n//   }","preventionTips":["Leave MinVersion and MaxVersion unset (0) if you do not need explicit version constraints","When constraining versions, always verify MinVersion <= MaxVersion","Use named constants (tls.VersionTLS12, tls.VersionTLS13) instead of raw hex values"],"tags":["tls","client-side","config","version-negotiation"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}