{"record":{"id":"1d8bed159b9b64cf","repo":"hashicorp/nomad","slug":"unsupported-tls-cipher-q","errorCode":null,"errorMessage":"unsupported TLS cipher %q","messagePattern":"unsupported TLS cipher %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"helper/tlsutil/config.go","lineNumber":396,"sourceCode":"\n// ParseCiphers parses ciphersuites from the comma-separated string into\n// recognized slice\nfunc ParseCiphers(tlsConfig *config.TLSConfig) ([]uint16, error) {\n\tsuites := []uint16{}\n\n\tcipherStr := strings.TrimSpace(tlsConfig.TLSCipherSuites)\n\n\tvar parsedCiphers []string\n\tif cipherStr == \"\" {\n\t\tparsedCiphers = defaultTLSCiphers\n\n\t} else {\n\t\tparsedCiphers = strings.Split(tlsConfig.TLSCipherSuites, \",\")\n\t}\n\tfor _, cipher := range parsedCiphers {\n\t\tc, ok := supportedTLSCiphers[cipher]\n\t\tif !ok {\n\t\t\treturn suites, fmt.Errorf(\"unsupported TLS cipher %q\", cipher)\n\t\t}\n\t\tsuites = append(suites, c)\n\t}\n\n\t// Ensure that the specified cipher suite list is supported by the TLS\n\t// Certificate signature algorithm. This is a check for user error, where a\n\t// TLS certificate could support RSA but a user has configured a cipher suite\n\t// list of ciphers where only ECDSA is supported.\n\tkeyLoader := tlsConfig.GetKeyLoader()\n\n\t// Ensure that the keypair has been loaded before continuing\n\tkeyLoader.LoadKeyPair(tlsConfig.CertFile, tlsConfig.KeyFile)\n\n\tif keyLoader.GetCertificate() != nil {\n\t\tsupportedSignatureAlgorithm, err := getSignatureAlgorithm(keyLoader.GetCertificate())\n\t\tif err != nil {\n\t\t\treturn []uint16{}, err\n\t\t}","sourceCodeStart":378,"sourceCodeEnd":414,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/helper/tlsutil/config.go#L378-L414","documentation":"ParseCiphers converts a comma-separated TLSCipherSuites string into []uint16 using the supportedTLSCiphers lookup table. Any cipher name not present in the table is rejected with this error. It prevents silently running with ciphers the library doesn't know.","triggerScenarios":"Calling ParseCiphers (via NewTLSConfiguration) with TLSCipherSuites containing a name not in supportedTLSCiphers, e.g. a misspelled name or a cipher not supported by Go's crypto/tls.","commonSituations":"Copying OpenSSL/OpenSSH cipher names (e.g. 'ECDHE-RSA-AES128-GCM-SHA256') instead of the Go/consul-style names like 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'; enabling TLS 1.3-only ciphers not in the table.","solutions":["Correct the cipher name to one supported by the library (e.g. TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384).","Remove the unsupported cipher from tls_cipher_suites and let the default set apply.","Check supportedTLSCiphers in helper/tlsutil/config.go for the exact accepted names."],"exampleFix":"// before\ntls_cipher_suites = \"ECDHE-RSA-AES128-GCM-SHA256\"\n// after\ntls_cipher_suites = \"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\"","handlingStrategy":"validation","validationCode":"supported := map[string]bool{ \"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256\": true, \"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\": true /* ...see supportedTLSCiphers */ }\nfor _, c := range strings.Split(tlsCipherSuites, \",\") {\n    if !supported[strings.TrimSpace(c)] {\n        return fmt.Errorf(\"cipher %q not supported\", c)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use only cipher names from supportedTLSCiphers.","Avoid copying OpenSSL-style cipher names into config.","Validate the tls stanza before rollout."],"tags":["tls","ciphersuite","configuration"],"backgroundTag":"unsupported-tls-cipher","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}