{"record":{"id":"16ce9565d139310d","repo":"golang/go","slug":"no-mutually-supported-protocol-versions","errorCode":null,"errorMessage":"no mutually supported protocol versions","messagePattern":"no mutually supported protocol versions","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/crypto/tls/common.go","lineNumber":1401,"sourceCode":"// callback, this method will take into account the associated [Config]. Note that\n// if GetConfigForClient returns a different [Config], the change can't be\n// accounted for by this method.\n//\n// This function will call x509.ParseCertificate unless c.Leaf is set, which can\n// incur a significant performance cost.\nfunc (chi *ClientHelloInfo) SupportsCertificate(c *Certificate) error {\n\t// Note we don't currently support certificate_authorities nor\n\t// signature_algorithms_cert, and don't check the algorithms of the\n\t// signatures on the chain (which anyway are a SHOULD, see RFC 8446,\n\t// Section 4.4.2.2).\n\n\tconfig := chi.config\n\tif config == nil {\n\t\tconfig = &Config{}\n\t}\n\tvers, ok := config.mutualVersion(roleServer, chi.isQUIC, chi.SupportedVersions)\n\tif !ok {\n\t\treturn errors.New(\"no mutually supported protocol versions\")\n\t}\n\n\t// If the client specified the name they are trying to connect to, the\n\t// certificate needs to be valid for it.\n\tif chi.ServerName != \"\" {\n\t\tx509Cert, err := c.leaf()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to parse certificate: %w\", err)\n\t\t}\n\t\tif err := x509Cert.VerifyHostname(chi.ServerName); err != nil {\n\t\t\treturn fmt.Errorf(\"certificate is not valid for requested server name: %w\", err)\n\t\t}\n\t}\n\n\t// supportsRSAFallback returns nil if the certificate and connection support\n\t// the static RSA key exchange, and unsupported otherwise. The logic for\n\t// supporting static RSA is completely disjoint from the logic for\n\t// supporting signed key exchanges, so we just check it as a fallback.","sourceCodeStart":1383,"sourceCodeEnd":1419,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/common.go#L1383-L1419","documentation":"Thrown by ClientHelloInfo.SupportsCertificate when config.mutualVersion finds no protocol version common to client and server. SupportsCertificate checks whether a given certificate is usable for the ClientHello; if the version negotiation fails first, no certificate can be selected, so this error is returned.","triggerScenarios":"Calling chi.SupportsCertificate(cert) where chi.SupportedVersions and the server's MinVersion/MaxVersion are disjoint (e.g., client offers TLS 1.0-1.1 only, server requires TLS 1.3). Reached at the top of SupportsCertificate.","commonSituations":"Server set MinVersion=TLS1.3 but an old client only supports TLS 1.2; client restricted MaxVersion below the server minimum; version skew after a security hardening that raised MinVersion.","solutions":["Align MinVersion/MaxVersion between client and server to a common range.","Lower the server MinVersion (with a documented risk assessment) to overlap the client.","Upgrade the client to a TLS stack that supports the server's minimum version.","Use SupportsCertificate to choose a cert only after confirming mutual version support."],"exampleFix":"// before\nsrvCfg.MinVersion = tls.VersionTLS13\ncliCfg.MaxVersion = tls.VersionTLS12 // no overlap\n\n// after\nsrvCfg.MinVersion = tls.VersionTLS12\ncliCfg.MaxVersion = tls.VersionTLS13 // overlap at TLS 1.2","handlingStrategy":"validation","validationCode":"// Confirm a client/server version range overlaps before relying on a cert.\nfunc versionsOverlap(clientMin, clientMax, serverMin, serverMax uint16) bool {\n    return clientMin <= serverMax && serverMin <= clientMax\n}\n// Or use chi.SupportsCertificate(cert) which returns this error when ranges are disjoint.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set explicit MinVersion/MaxVersion on both client and server and document the range.","Before raising MinVersion, survey clients for version support.","Treat SupportsCertificate errors as guidance for cert selection, not fatal.","Log negotiated versions in staging to detect version skew early."],"tags":["crypto","tls","version-negotiation","go"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}