{"record":{"id":"4865cfe7c3f19e80","repo":"elastic/elasticsearch","slug":"cannot-configure-ssl-tls-without-any-supported-cip","errorCode":null,"errorMessage":"cannot configure SSL/TLS without any supported cipher suites","messagePattern":"cannot configure SSL/TLS without any supported cipher suites","errorType":"exception","errorClass":"SslConfigException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfiguration.java","lineNumber":81,"sourceCode":"        protocolAlgorithmMap.put(\"SSLv2Hello\", \"SSL\");\n        ORDERED_PROTOCOL_ALGORITHM_MAP = Collections.unmodifiableMap(protocolAlgorithmMap);\n    }\n\n    public SslConfiguration(\n        String settingPrefix,\n        boolean explicitlyConfigured,\n        SslTrustConfig trustConfig,\n        SslKeyConfig keyConfig,\n        SslVerificationMode verificationMode,\n        SslClientAuthenticationMode clientAuth,\n        List<String> ciphers,\n        List<String> supportedProtocols,\n        long handshakeTimeoutMillis\n    ) {\n        this.settingPrefix = settingPrefix;\n        this.explicitlyConfigured = explicitlyConfigured;\n        if (ciphers == null || ciphers.isEmpty()) {\n            throw new SslConfigException(\"cannot configure SSL/TLS without any supported cipher suites\");\n        }\n        if (supportedProtocols == null || supportedProtocols.isEmpty()) {\n            throw new SslConfigException(\"cannot configure SSL/TLS without any supported protocols\");\n        }\n        this.trustConfig = Objects.requireNonNull(trustConfig, \"trust config cannot be null\");\n        this.keyConfig = Objects.requireNonNull(keyConfig, \"key config cannot be null\");\n        this.verificationMode = Objects.requireNonNull(verificationMode, \"verification mode cannot be null\");\n        this.clientAuth = Objects.requireNonNull(clientAuth, \"client authentication cannot be null\");\n        if (handshakeTimeoutMillis < 1L) {\n            throw new SslConfigException(\"handshake timeout must be at least 1ms\");\n        }\n        this.handshakeTimeoutMillis = handshakeTimeoutMillis;\n        this.ciphers = Collections.unmodifiableList(ciphers);\n        this.supportedProtocols = Collections.unmodifiableList(supportedProtocols);\n    }\n\n    public List<String> getCipherSuites() {\n        return ciphers;","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfiguration.java#L63-L99","documentation":"The SslConfiguration constructor rejects a null or empty cipher list because an empty cipher set would make TLS negotiation impossible. This is a hard precondition on the value passed as `ciphers`.","triggerScenarios":"Constructing SslConfiguration with ciphers=null or ciphers=[]. In normal use this is reached only if SslConfigurationLoader resolves ssl.cipher_suites to an empty list AND the default fallback is also empty — the loader has its own empty-check (error 830) that normally fires first.","commonSituations":"A custom SslConfigurationLoader subclass overrides default ciphers to empty; programmatic construction of SslConfiguration with an explicitly empty list; a test helper that builds a config without populating ciphers.","solutions":["Pass a non-empty cipher list, ideally from SslConfigurationLoader.DEFAULT_CIPHERS.","If loading from settings, remove the empty ssl.cipher_suites override so defaults apply.","In custom loaders, never return an empty list from the cipher resolution path — fall back to DEFAULT_CIPHERS."],"exampleFix":"// before\nnew SslConfiguration(prefix, true, trust, key, mode, auth,\n    List.of(), protocols, 10_000L); // empty ciphers\n// after\nnew SslConfiguration(prefix, true, trust, key, mode, auth,\n    SslConfigurationLoader.DEFAULT_CIPHERS, protocols, 10_000L);","handlingStrategy":"validation","validationCode":"List<String> ensureCiphers(List<String> ciphers) {\n    if (ciphers == null || ciphers.isEmpty())\n        return SslConfigurationLoader.DEFAULT_CIPHERS;\n    return ciphers;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always default to SslConfigurationLoader.DEFAULT_CIPHERS in programmatic construction.","Never construct SslConfiguration with a list literal that may be empty.","Unit-test custom loader paths with an explicit empty-list input."],"tags":["ssl","config","ciphers","validation"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}