{"record":{"id":"37b64388bffde1a3","repo":"thanos-io/thanos","slug":"invalid-cipher-suite-s-valid-values-are-s","errorCode":null,"errorMessage":"invalid cipher suite: %s, valid values are %s","messagePattern":"invalid cipher suite: (.+?), valid values are (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/tls/options.go","lineNumber":266,"sourceCode":"\t\treturn nil, nil\n\t}\n\n\tsupported := tls.CipherSuites()\n\tcipherMap := make(map[string]uint16, len(supported))\n\tfor _, cs := range supported {\n\t\tcipherMap[cs.Name] = cs.ID\n\t}\n\tvalidNames := make([]string, 0, len(cipherMap))\n\tfor n := range cipherMap {\n\t\tvalidNames = append(validNames, n)\n\t}\n\tsort.Strings(validNames)\n\n\tids := make([]uint16, 0, len(ciphers))\n\tfor _, name := range ciphers {\n\t\tid, ok := cipherMap[name]\n\t\tif !ok {\n\t\t\treturn nil, errors.New(fmt.Sprintf(\"invalid cipher suite: %s, valid values are %s\", name, strings.Join(validNames, \", \")))\n\t\t}\n\t\tids = append(ids, id)\n\t}\n\treturn ids, nil\n}\n\nfunc getCurveIDs(curves []string) ([]tls.CurveID, error) {\n\tif len(curves) == 0 {\n\t\treturn nil, nil\n\t}\n\n\t// Manual mapping since crypto/tls doesn't provide enumeration\n\tcurveMap := map[string]tls.CurveID{\n\t\t\"CurveP256\":          tls.CurveP256,\n\t\t\"CurveP384\":          tls.CurveP384,\n\t\t\"CurveP521\":          tls.CurveP521,\n\t\t\"X25519\":             tls.X25519,\n\t\t\"X25519MLKEM768\":     tls.X25519MLKEM768,","sourceCodeStart":248,"sourceCodeEnd":284,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/pkg/tls/options.go#L248-L284","documentation":"getCipherSuiteIDs maps cipher suite names from the TLS config to Go's uint16 IDs. Any name not present in the known cipherMap produces this error listing all accepted names. It is a strict enum-style validation of the cipher-suites option.","triggerScenarios":"NewServerConfig is called with a cipher-suites list containing an unrecognized name (typo, OpenSSL-style name like TLS_AES_256_GCM_SHA384 vs Go's naming, TLS 1.3 suite names that Go configures separately, or deprecated suite removed from the map).","commonSituations":"Config copied from nginx/openssl documentation using different naming conventions; including TLS 1.3 ciphers (in Go they are not settable via CipherSuites); typo such as TLS_RSA_WITH_3DES... removed from Go; older/newer config versions with renamed suites.","solutions":["Use exactly one of the names printed in the error message (copy-paste from the valid values list).","Remove TLS 1.3 cipher names — Go always enables them and does not accept them in CipherSuites.","Update config to names matching this library's cipherMap (see pkg/tls/options.go).","Fix typos/case — names are matched exactly."],"exampleFix":"# before\ntls_cipher_suites: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_AES_128_GCM_SHA256\n# after\ntls_cipher_suites: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384  # pick from the valid-values list only","handlingStrategy":"validation","validationCode":"func validCipherNames(names []string, valid map[string]uint16) error {\n    for _, n := range names {\n        if _, ok := valid[n]; !ok {\n            return fmt.Errorf(\"unknown cipher suite %q\", n)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"_, err := tls.NewServerConfig(logger, cipherSuites, curves, ver, ...)\nif err != nil && strings.Contains(err.Error(), \"invalid cipher suite\") {\n    return fmt.Errorf(\"fix tls.cipher_suites config: %w\", err)\n}","preventionTips":["Copy cipher names from the library's valid-values list, not OpenSSL docs.","Never list TLS 1.3 ciphers in Go CipherSuites config.","Keep a config schema/linter for TLS options.","Pin configs to the library version they were written for."],"tags":["tls","config","validation","ciphers"],"backgroundTag":"invalid-enum-value","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}