{"record":{"id":"2062d1b1f3023d74","repo":"semaphoreui/semaphore","slug":"unsupported-tls-version-s","errorCode":null,"errorMessage":"unsupported TLS version %s","messagePattern":"unsupported TLS version (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/mailer/mailer.go","lineNumber":48,"sourceCode":"\t\"\\r\", \"\",\n\t\"\\n\", \"\",\n\t\"%0a\", \"\",\n\t\"%0d\", \"\",\n)\n\nfunc parseTlsVersion(version string) (uint16, error) {\n\tswitch version {\n\tcase \"1.0\":\n\t\treturn tls.VersionTLS10, nil\n\tcase \"1.1\":\n\t\treturn tls.VersionTLS11, nil\n\tcase \"1.2\":\n\t\treturn tls.VersionTLS12, nil\n\tcase \"1.3\":\n\t\treturn tls.VersionTLS13, nil\n\t}\n\n\treturn 0, fmt.Errorf(\"unsupported TLS version %s\", version)\n}\n\n// Send simply sends the defined mail via SMTP.\nfunc Send(\n\tsecure bool,\n\tuseTls bool,\n\thost string,\n\tport string,\n\tusername,\n\tpassword,\n\tfrom,\n\tto,\n\tsubject string,\n\tcontent string,\n) error {\n\tbody := bytes.NewBufferString(\"\")\n\ttpl, err := template.New(\"\").Parse(mailerBase)\n\tif err != nil {","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/semaphoreui/semaphore/blob/1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa/util/mailer/mailer.go#L30-L66","documentation":"parseTlsVersion maps a TLS version string (e.g. \"1.2\", \"1.3\") to the corresponding crypto/tls constant used when dialing the SMTP server. When the configured version string matches neither known case, the function returns 0 plus this error, and sendTls aborts the mail send. It is a configuration-validation guard ensuring the mailer never attempts a handshake with an invalid tls.Version value.","triggerScenarios":"Setting the mailer's TLS version config to any string other than exactly \"1.2\" or \"1.3\" (case-sensitive, no \"TLS \" prefix, no \"v\") so parseTlsVersion falls through the switch and returns the error from util/mailer/mailer.go:48.","commonSituations":"Config files with values like \"tls1.2\", \"TLSv1.2\", \"1.1\", \"1.0\", or a version written with wrong casing/whitespace; older configs predating TLS 1.3 support; environment variable interpolation yielding an empty or unexpected string.","solutions":["Change the configured TLS version to exactly \"1.2\" or \"1.3\" (case-sensitive).","If the SMTP server only supports TLS 1.0/1.1, upgrade the server or remove the explicit version setting rather than forcing an unsupported value.","Trim/normalize the value at the config-loading layer (e.g. strings.TrimSpace, lowercase) before passing it to parseTlsVersion.","Verify the environment variable or YAML key actually feeding the value is populated and has no quotes or stray characters."],"exampleFix":"// before (config)\nsmtp_tls_version: \"TLSv1.2\"\n\n// after\nsmtp_tls_version: \"1.2\"","handlingStrategy":"validation","validationCode":"const allowed = new Set(['1.2', '1.3']);\nif (!allowed.has(cfg.smtp_tls_version)) {\n  throw new Error(`smtp_tls_version must be \"1.2\" or \"1.3\", got: ${cfg.smtp_tls_version}`);\n}","typeGuard":"function isValidTlsVersion(v) {\n  return v === '1.2' || v === '1.3';\n}","tryCatchPattern":null,"preventionTips":["Keep TLS version strings in a validated enum/constant list at config load time.","Test mailer config parsing in CI with every supported and one unsupported value.","Document the accepted values next to the config key so operators don't guess formats.","Normalize input (trim, strip 'TLS '/'v' prefixes) before mapping to tls constants."],"tags":["tls","email","configuration","validation"],"backgroundTag":"invalid-config-value","analyzedSha":"1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa","analyzedAt":"2026-09-07T11:00:33.293Z","contentChangedAt":"2026-09-07T11:00:33.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}