{"record":{"id":"0dd96aea98d01fbc","repo":"denoland/deno","slug":"err-tls-protocol-version-conflict","errorCode":"ERR_TLS_PROTOCOL_VERSION_CONFLICT","errorMessage":"TLS protocol version ${options.minVersion || options.maxVersion} conflicts with secureProtocol secureProtocol","messagePattern":"TLS protocol version (.+?) conflicts with secureProtocol secureProtocol","errorType":"exception","errorClass":"NodeTypeError","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/_tls_common.ts","lineNumber":297,"sourceCode":"    return ArrayPrototypeFilter(\n      ArrayPrototypeMap(val, (v: any) => toStringOrUndefined(v)!),\n      Boolean,\n    );\n  }\n  return toStringOrUndefined(val);\n}\n\nfunction getProtocolRange(\n  options: any,\n): { minVersion: string; maxVersion: string } {\n  let minVersion = getDefaultMinVersion();\n  let maxVersion = getDefaultMaxVersion();\n\n  if (options.secureProtocol) {\n    // If secureProtocol is set, minVersion/maxVersion must not also be set.\n    // Node raises this conflict before validating the protocol method string.\n    if (options.minVersion || options.maxVersion) {\n      throw new ERR_TLS_PROTOCOL_VERSION_CONFLICT(\n        options.minVersion || options.maxVersion,\n        \"secureProtocol\",\n      );\n    }\n\n    const range = kProtocolMap[options.secureProtocol];\n    if (!range) {\n      if (\n        options.secureProtocol === \"SSLv2_method\" ||\n        options.secureProtocol === \"SSLv2_client_method\" ||\n        options.secureProtocol === \"SSLv2_server_method\"\n      ) {\n        throw new ERR_TLS_INVALID_PROTOCOL_METHOD(\"SSLv2 methods disabled\");\n      }\n      if (\n        options.secureProtocol === \"SSLv3_method\" ||\n        options.secureProtocol === \"SSLv3_client_method\" ||\n        options.secureProtocol === \"SSLv3_server_method\"","sourceCodeStart":279,"sourceCodeEnd":315,"githubUrl":"https://github.com/denoland/deno/blob/89f33cbef296a2b287f323d42de54c871fa69c77/ext/node/polyfills/_tls_common.ts#L279-L315","documentation":"getProtocolRange resolves the TLS version range from options. If options.secureProtocol is set (the legacy OpenSSL method-string API) and minVersion or maxVersion is also set, the two mechanisms conflict and it throws ERR_TLS_PROTOCOL_VERSION_CONFLICT before the method string is even validated - exactly Node's ordering.","triggerScenarios":"new tls.TLSSocket(sock, { secureProtocol: 'TLSv1_2_method', minVersion: 'TLSv1.2' }); https.createServer({ secureProtocol: 'SSLv23_method', maxVersion: 'TLSv1.3' }); any options object carrying both knob styles.","commonSituations":"Migrating secureProtocol-era code and adding modern minVersion tuning without removing the legacy field; merging TLS options from multiple sources (base config + overrides); copy-pasted snippets that mix the two APIs.","solutions":["Delete secureProtocol and keep minVersion/maxVersion (the modern API)","Or keep secureProtocol alone and remove minVersion/maxVersion","Normalize merged option objects so the legacy field never survives alongside version pins","Standardize new code on minVersion: 'TLSv1.2' style"],"exampleFix":"// before\nconst opts = {\n  secureProtocol: 'TLSv1_2_method',\n  minVersion: 'TLSv1.2', // conflict -> throws\n};\n\n// after\nconst opts = { minVersion: 'TLSv1.2', maxVersion: 'TLSv1.3' };","handlingStrategy":"validation","validationCode":"function normalizeTlsOptions(o) {\n  if (o.secureProtocol && (o.minVersion || o.maxVersion)) {\n    delete o.secureProtocol; // modern version knobs win\n  }\n  return o;\n}","typeGuard":null,"tryCatchPattern":"try {\n  sock = new tls.TLSSocket(s, opts);\n} catch (e) {\n  if (e.code === 'ERR_TLS_PROTOCOL_VERSION_CONFLICT') {\n    const { secureProtocol, ...rest } = opts;\n    sock = new tls.TLSSocket(s, rest);\n  } else throw e;\n}","preventionTips":["Pick one TLS-version API per codebase and lint for the other","Deep-merge TLS configs consciously; log when legacy secureProtocol is dropped","Pin versions via minVersion/maxVersion, not method strings"],"tags":["tls","configuration","security","node-compat"],"backgroundTag":null,"analyzedSha":"89f33cbef296a2b287f323d42de54c871fa69c77","analyzedAt":"2026-08-16T07:54:21.310Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}