{"record":{"id":"2477a493a839a363","repo":"fluent/fluentd","slug":"when-you-set-max-version-must-set-min-version-tog","errorCode":null,"errorMessage":"When you set max_version, must set min_version together","messagePattern":"When you set max_version, must set min_version together","errorType":"exception","errorClass":"Fluent::ConfigError","httpStatus":null,"severity":"error","filePath":"lib/fluent/tls.rb","lineNumber":63,"sourceCode":"                      TLS1_1: :'TLSv1_1',\n                      TLS1_2: :'TLSv1_2',\n                    }.freeze\n                    MIN_MAX_AVAILABLE = false\n                    map\n                  end\n    private_constant :METHODS_MAP\n\n    # Helper for old syntax/method support:\n    # ruby 2.4 uses ssl_version= but this method is now deprecated.\n    # min_version=/max_version= use 'TLS1_2' but ssl_version= uses 'TLSv1_2'\n    def set_version_to_context(ctx, version, min_version, max_version)\n      if MIN_MAX_AVAILABLE\n        case\n        when min_version.nil? && max_version.nil?\n          min_version = METHODS_MAP[version] || version\n          max_version = METHODS_MAP[version] || version\n        when min_version.nil? && max_version\n          raise Fluent::ConfigError, \"When you set max_version, must set min_version together\"\n        when min_version && max_version.nil?\n          raise Fluent::ConfigError, \"When you set min_version, must set max_version together\"\n        else\n          min_version = METHODS_MAP[min_version] || min_version\n          max_version = METHODS_MAP[max_version] || max_version\n        end\n        ctx.min_version = min_version\n        ctx.max_version = max_version\n      else\n        ctx.ssl_version = METHODS_MAP[version] || version\n      end\n\n      ctx\n    end\n    module_function :set_version_to_context\n\n    def set_version_to_options(opt, version, min_version, max_version)\n      if MIN_MAX_AVAILABLE","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/fluent/fluentd/blob/dd45c6e18dc7be33b5e5a0f0767bf46307ff5626/lib/fluent/tls.rb#L45-L81","documentation":"Fluent::ConfigError raised by Fluent::TLS.set_version_to_context (lib/fluent/tls.rb:63) when configuring an SSLContext for TLS transports: max_version was supplied but min_version was not. On Rubies with OpenSSL min_version/max_version support (MIN_MAX_AVAILABLE), fluentd requires the pair to be set together so the enabled protocol range is explicit; a lone max_version would leave the floor ambiguous.","triggerScenarios":"A TLS plugin section (in_forward/in_http TLS, out_forward TLS, etc.) setting max_version TLS1_3 without min_version, while ssl_version (the legacy single-value option) is unset. Both nil is fine (version default applies); min_version alone or max_version alone raises.","commonSituations":"Hardening configs: an operator adds max_version TLS1_3 to cap protocols but forgets the floor; copying a partial example from docs; migrating from deprecated ssl_version to min/max syntax and dropping one line.","solutions":["Add the matching min_version, e.g. min_version TLS1_2 together with max_version TLS1_3","Or remove max_version and use the single legacy ssl_version / version option (e.g. version TLSv1_2) when you want exactly one protocol","Validate the config with fluentd --dry-run before deploying TLS changes"],"exampleFix":"# before\n<transport tls>\n  cert_path /etc/fluent/cert.pem\n  max_version TLS1_3\n</transport>\n\n# after\n<transport tls>\n  cert_path /etc/fluent/cert.pem\n  min_version TLS1_2\n  max_version TLS1_3\n</transport>","handlingStrategy":"validation","validationCode":"min_version = nil\nmax_version = :TLS1_3\nraise 'min_version required with max_version' if max_version && min_version.nil?\n# or pre-normalize: min_version ||= :TLS1_2","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always write min_version and max_version as a pair in TLS sections","fluentd --dry-run validates the pair before restart","Prefer the pair syntax over deprecated ssl_version for new configs"],"tags":["fluentd","tls","ssl","configuration","startup"],"backgroundTag":"tls-version-misconfiguration","analyzedSha":"dd45c6e18dc7be33b5e5a0f0767bf46307ff5626","analyzedAt":"2026-08-21T16:22:07.332Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}