{"record":{"id":"2e0cb09194ab7dd1","repo":"VictoriaMetrics/VictoriaMetrics","slug":"cannot-parse-min-version-w","errorCode":null,"errorMessage":"cannot parse `min_version`: %w","messagePattern":"cannot parse `min_version`: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/promauth/config.go","lineNumber":993,"sourceCode":"\t\ttctx.tlsRootCADigest = fmt.Sprintf(\"digest(CA)=%d\", h)\n\t} else if tc.CAFile != \"\" {\n\t\tpath := fscore.GetFilepath(baseDir, tc.CAFile)\n\t\ttctx.getTLSRootCA = func() (*x509.CertPool, error) {\n\t\t\tdata, err := fscore.ReadFileOrHTTP(path)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"cannot read `ca_file`: %w\", err)\n\t\t\t}\n\t\t\trootCA := x509.NewCertPool()\n\t\t\tif !rootCA.AppendCertsFromPEM(data) {\n\t\t\t\treturn nil, fmt.Errorf(\"cannot parse data read from `ca_file` %q\", tc.CAFile)\n\t\t\t}\n\t\t\treturn rootCA, nil\n\t\t}\n\t\ttctx.tlsRootCADigest = fmt.Sprintf(\"caFile=%q\", tc.CAFile)\n\t}\n\tv, err := netutil.ParseTLSVersion(tc.MinVersion)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot parse `min_version`: %w\", err)\n\t}\n\ttctx.minVersion = v\n\treturn nil\n}\n","sourceCodeStart":975,"sourceCodeEnd":998,"githubUrl":"https://github.com/VictoriaMetrics/VictoriaMetrics/blob/5079fb58f1e8e62113f90c945ad71586c797d770/lib/promauth/config.go#L975-L998","documentation":"Fires in tlsContext.initFromTLSConfig when tls_config.min_version cannot be parsed by netutil.ParseTLSVersion. It means the configured minimum TLS version string is not a recognized value (valid: TLS10, TLS11, TLS12, TLS13); the wrapped error explains why parsing failed.","triggerScenarios":"Setting min_version to values like 'TLSv1.2' vs accepted alias, '1.2', 'tls-1.2', lowercase/typo variants the parser does not recognize, or an empty-but-whitespace value.","commonSituations":"Copying config from Prometheus or curl docs whose accepted tokens differ; using 'TLS 1.3' with a space; downgrading configs between library versions where alias sets changed.","solutions":["Use one of the accepted values: TLS10, TLS11, TLS12, TLS13 (case-insensitive per netutil.ParseTLSVersion)","Replace numeric forms like '1.2' with 'TLS12'","Check netutil.ParseTLSVersion in lib/netutil for the exact alias list supported by this version","Remove the min_version field entirely to use the Go default"],"exampleFix":"// before\nmin_version: TLSv1.3_with_fallback\n// after\nmin_version: TLS13","handlingStrategy":"try-catch","validationCode":"// pre-validate min_version against the values netutil.ParseTLSVersion accepts\nallowed := map[string]bool{\"tls10\": true, \"tls11\": true, \"tls12\": true, \"tls13\": true}\nif cfg.TLS.MinVersion != \"\" && !allowed[strings.ToLower(strings.TrimSpace(cfg.TLS.MinVersion))] {\n\treturn fmt.Errorf(\"min_version %q not accepted; use TLS10/TLS11/TLS12/TLS13\", cfg.TLS.MinVersion)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only use the canonical tokens TLS10-TLS13 in configs","Pin a config schema/linter (e.g. JSON schema check in CI) for TLS fields","Omit min_version unless a compliance requirement forces it","Consult netutil.ParseTLSVersion in this repo for the authoritative alias list before copying external examples"],"tags":["tls","configuration","validation"],"backgroundTag":"invalid-config-value","analyzedSha":"5079fb58f1e8e62113f90c945ad71586c797d770","analyzedAt":"2026-09-03T18:10:26.153Z","contentChangedAt":"2026-09-03T18:10:26.153Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}