{"record":{"id":"33e8b9688d8660de","repo":"denoland/deno","slug":"err-tls-invalid-protocol-version","errorCode":"ERR_TLS_INVALID_PROTOCOL_VERSION","errorMessage":"${options.minVersion} is not a valid minVersion TLS protocol version","messagePattern":"(.+?) is not a valid minVersion TLS protocol version","errorType":"error_code","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/_tls_common.ts","lineNumber":329,"sourceCode":"      }\n      if (\n        options.secureProtocol === \"SSLv3_method\" ||\n        options.secureProtocol === \"SSLv3_client_method\" ||\n        options.secureProtocol === \"SSLv3_server_method\"\n      ) {\n        throw new ERR_TLS_INVALID_PROTOCOL_METHOD(\"SSLv3 methods disabled\");\n      }\n      throw new ERR_TLS_INVALID_PROTOCOL_METHOD(\n        `Unknown method: ${options.secureProtocol}`,\n      );\n    }\n\n    minVersion = range[0];\n    maxVersion = range[1];\n  } else {\n    if (options.minVersion) {\n      if (!SetPrototypeHas(kValidVersions, options.minVersion)) {\n        throw new ERR_TLS_INVALID_PROTOCOL_VERSION(\n          options.minVersion,\n          \"minVersion\",\n        );\n      }\n      minVersion = options.minVersion;\n    }\n    if (options.maxVersion) {\n      if (!SetPrototypeHas(kValidVersions, options.maxVersion)) {\n        throw new ERR_TLS_INVALID_PROTOCOL_VERSION(\n          options.maxVersion,\n          \"maxVersion\",\n        );\n      }\n      maxVersion = options.maxVersion;\n    }\n  }\n\n  return { minVersion, maxVersion };","sourceCodeStart":311,"sourceCodeEnd":347,"githubUrl":"https://github.com/denoland/deno/blob/89f33cbef296a2b287f323d42de54c871fa69c77/ext/node/polyfills/_tls_common.ts#L311-L347","documentation":"When secureProtocol is absent, getProtocolRange validates minVersion against the kValidVersions set; a value not in the set throws ERR_TLS_INVALID_PROTOCOL_VERSION reporting that the value is not a valid minVersion. Valid strings are the exact forms 'TLSv1.3', 'TLSv1.2', 'TLSv1.1', 'TLSv1' - other spellings, numbers, or casing fail.","triggerScenarios":"minVersion: 'tls1.2' (lowercase), 'TLSv1.4' (nonexistent), 'TLS1_2' (wrong shape), 1.2 as a number, or 'SSLv3' - none of which are in kValidVersions.","commonSituations":"Format confusion with OpenSSL/browser cipher config ('TLSv1.2' vs 'tlsv1.2' vs '1.2'); values read from env vars or YAML without normalization; copy-paste from platform-specific docs.","solutions":["Use the exact strings: 'TLSv1.3' | 'TLSv1.2' | 'TLSv1.1' | 'TLSv1'","Validate against a whitelist before creating the TLS socket/server","Trim and canonicalize values coming from config/env","Omit minVersion to accept the library default rather than guessing spellings"],"exampleFix":"// before\nnew tls.TLSSocket(s, { minVersion: 'tls1.2' }); // invalid string\n\n// after\nnew tls.TLSSocket(s, { minVersion: 'TLSv1.2' });","handlingStrategy":"validation","validationCode":"const VALID_VERSIONS = ['TLSv1.3', 'TLSv1.2', 'TLSv1.1', 'TLSv1'];\nif (opts.minVersion && !VALID_VERSIONS.includes(opts.minVersion)) {\n  delete opts.minVersion; // or throw with a clear config error\n}\nif (opts.maxVersion && !VALID_VERSIONS.includes(opts.maxVersion)) {\n  delete opts.maxVersion;\n}","typeGuard":"function isTlsVersion(v) {\n  return v === 'TLSv1.3' || v === 'TLSv1.2' || v === 'TLSv1.1' || v === 'TLSv1';\n}","tryCatchPattern":"try {\n  sock = new tls.TLSSocket(s, opts);\n} catch (e) {\n  if (e.code === 'ERR_TLS_INVALID_PROTOCOL_VERSION' && /minVersion/.test(e.message)) {\n    const { minVersion, ...rest } = opts;\n    sock = new tls.TLSSocket(s, rest);\n  } else throw e;\n}","preventionTips":["Centralize the exact version strings in one constants module","Trim and validate env/YAML-sourced version strings at load time","Omit minVersion when the library default is acceptable"],"tags":["tls","validation","configuration","node-compat"],"backgroundTag":null,"analyzedSha":"89f33cbef296a2b287f323d42de54c871fa69c77","analyzedAt":"2026-08-16T07:54:21.310Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}