{"record":{"id":"3eaa33829a43cd23","repo":"elastic/elasticsearch","slug":"no-supported-ssl-tls-protocol-was-found-in-the-con","errorCode":null,"errorMessage":"no supported SSL/TLS protocol was found in the configured supported protocols: {}","messagePattern":"no supported SSL/TLS protocol was found in the configured supported protocols: (.+?)","errorType":"exception","errorClass":"SslConfigException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfiguration.java","lineNumber":156,"sourceCode":"        } catch (GeneralSecurityException e) {\n            throw new SslConfigException(\"cannot create ssl context\", e);\n        }\n    }\n\n    /**\n     * Picks the best (highest security / most recent standard) SSL/TLS protocol (/version) that is supported by the\n     * {@link #supportedProtocols() configured protocols}.\n     */\n    private String contextProtocol() {\n        if (supportedProtocols.isEmpty()) {\n            throw new SslConfigException(\"no SSL/TLS protocols have been configured\");\n        }\n        for (Entry<String, String> entry : ORDERED_PROTOCOL_ALGORITHM_MAP.entrySet()) {\n            if (supportedProtocols.contains(entry.getKey())) {\n                return entry.getValue();\n            }\n        }\n        throw new SslConfigException(\n            \"no supported SSL/TLS protocol was found in the configured supported protocols: \" + supportedProtocols\n        );\n    }\n}\n","sourceCodeStart":138,"sourceCodeEnd":161,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfiguration.java#L138-L161","documentation":"contextProtocol iterates ORDERED_PROTOCOL_ALGORITHM_MAP (a fixed TLS-version to JCA-algorithm map) and returns the first configured protocol that appears in it. If none of the user's supportedProtocols match a known entry, no algorithm can be selected for SSLContext.getInstance.","triggerScenarios":"Configuring ssl.supported_protocols with values outside ORDERED_PROTOCOL_ALGORITHM_MAP — e.g. \"SSLv2Hello\", \"SSLv3\", \"TLSv1.1\" when the map only recognises TLSv1.2/TLSv1.3, or typo'd names like \"TLS1.2\" or \"tlsv1.2\".","commonSituations":"Lock-down config that whitelists only an old/deprecated protocol; copy-paste from a nginx/HAProxy config using a different naming convention; case sensitivity.","solutions":["Include at least one of TLSv1.2 or TLSv1.3 in ssl.supported_protocols (the values that map to a JCA algorithm).","Remove deprecated protocols (SSLv3, TLSv1, TLSv1.1) from the list — they are not in the algorithm map.","Check spelling and case: use the exact IETF token, e.g. \"TLSv1.3\" not \"tlsv1.3\" or \"TLS 1.3\"."],"exampleFix":"// before\nxpack.security.http.ssl.supported_protocols: [ \"SSLv3\", \"TLSv1\" ]\n// after\nxpack.security.http.ssl.supported_protocols: [ \"TLSv1.2\", \"TLSv1.3\" ]","handlingStrategy":"validation","validationCode":"private static final Set<String> KNOWN_TLS = Set.of(\"TLSv1.2\",\"TLSv1.3\");\nvoid verifyProtocols(List<String> configured) {\n    if (configured.stream().noneMatch(KNOWN_TLS::contains))\n        throw new IllegalArgumentException(\n            \"ssl.supported_protocols must include at least one of \" + KNOWN_TLS +\n            \"; got \" + configured);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Standardise on TLSv1.2/TLSv1.3 across all ssl.* prefixes.","Lint supported_protocols in CI to reject deprecated protocol names.","Use exact IETF tokens (case-sensitive): 'TLSv1.3', not 'tlsv1.3' or 'TLS 1.3'."],"tags":["ssl","protocols","config","tls"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}