{"record":{"id":"2d9476cd58264e9b","repo":"cloudflare/cloudflared","slug":"s-has-unknown-tls-settings","errorCode":null,"errorMessage":"%s has unknown TLS settings","messagePattern":"(.+?) has unknown TLS settings","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/tunnel/configuration.go","lineNumber":158,"sourceCode":"\ttags = append(tags, pogs.Tag{Name: \"ID\", Value: clientConfig.ConnectorID.String()})\n\n\tcfg := config.GetConfiguration()\n\tingressRules, err := ingress.ParseIngressFromConfigAndCLI(cfg, c, log)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\n\tprotocolSelector, err := connection.NewProtocolSelector(transportProtocol, log)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\tlog.Info().Msgf(\"Initial protocol %s\", protocolSelector.Current())\n\n\tedgeTLSConfigs := make(map[connection.Protocol]*tls.Config, len(connection.ProtocolList))\n\tfor _, p := range connection.ProtocolList {\n\t\ttlsSettings := p.TLSSettings()\n\t\tif tlsSettings == nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"%s has unknown TLS settings\", p)\n\t\t}\n\t\tedgeTLSConfig, err := tlsconfig.CreateTunnelConfig(c.String(flags.CACert), tlsSettings.ServerName)\n\t\tif err != nil {\n\t\t\treturn nil, nil, errors.Wrap(err, \"unable to create TLS config to connect with edge\")\n\t\t}\n\t\tif len(tlsSettings.NextProtos) > 0 {\n\t\t\tedgeTLSConfig.NextProtos = tlsSettings.NextProtos\n\t\t}\n\t\tedgeTLSConfigs[p] = edgeTLSConfig\n\t}\n\n\tgracePeriod, err := gracePeriod(c)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\tedgeIPVersion, err := parseConfigIPVersion(c.String(flags.EdgeIpVersion))\n\tif err != nil {\n\t\treturn nil, nil, err","sourceCodeStart":140,"sourceCodeEnd":176,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/tunnel/configuration.go#L140-L176","documentation":"Each supported edge connection Protocol must return non-nil TLSSettings(); if a protocol in connection.ProtocolList yields nil, prepareTunnelConfig aborts because it cannot build the edge TLS config for that protocol. This indicates an internal inconsistency between the protocol registry and its TLS metadata.","triggerScenarios":"Iterating connection.ProtocolList during prepareTunnelConfig when a registered protocol (e.g. a newly added or experimental protocol) has no TLSSettings mapping — essentially a build/registry bug, not user configuration.","commonSituations":"Custom forks or patched builds where a new connection.Protocol was added to ProtocolList but TLSSettings() was not updated; mismatched vendored copies of the connection package.","solutions":["Update cloudflared to an official release — this should never occur on stock builds.","If building a fork, implement TLSSettings() for every protocol added to connection.ProtocolList.","Report the issue with the protocol name from the message if it reproduces on an official binary."],"exampleFix":"// before (fork)\nfunc (p Protocol) TLSSettings() *TLSSettings { if p == MyProto { return nil } ... }\n// after\nfunc (p Protocol) TLSSettings() *TLSSettings { if p == MyProto { return &TLSSettings{ServerName: \"...\", NextProtos: []string{\"...\"}} } ... }","handlingStrategy":"retry","validationCode":"// Only stock protocol values are safe: quic, http2\n[[ \"$PROTOCOL\" =~ ^(quic|http2|auto)$ ]] || { echo \"unsupported protocol $PROTOCOL\"; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use official cloudflared binaries.","Avoid forks/patches that add protocols without updating TLSSettings().","If it occurs, reproduce on the latest release before filing a bug."],"tags":["tls","internal","protocol"],"backgroundTag":"internal-invariant-violation","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}