{"record":{"id":"49ad9451f6dba786","repo":"istio/istio","slug":"cipher-suite-s-not-supported-or-doesn-t-exist","errorCode":null,"errorMessage":"cipher suite %s not supported or doesn't exist","messagePattern":"cipher suite (.+?) not supported or doesn't exist","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pilot/pkg/bootstrap/options.go","lineNumber":191,"sourceCode":"\t\tacceptedCiphers[cipher.Name] = cipher.ID\n\t}\n\tfor _, cipher := range tls.CipherSuites() {\n\t\tacceptedCiphers[cipher.Name] = cipher.ID\n\t}\n\treturn acceptedCiphers\n}\n\n// TLSCipherSuites returns a list of cipher suite IDs from the cipher suite names passed.\nfunc TLSCipherSuites(cipherNames []string) ([]uint16, error) {\n\tif len(cipherNames) == 0 {\n\t\treturn nil, nil\n\t}\n\tciphersIntSlice := make([]uint16, 0)\n\tpossibleCiphers := allCiphers()\n\tfor _, cipher := range cipherNames {\n\t\tintValue, ok := possibleCiphers[cipher]\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"cipher suite %s not supported or doesn't exist\", cipher)\n\t\t}\n\t\tciphersIntSlice = append(ciphersIntSlice, intValue)\n\t}\n\treturn ciphersIntSlice, nil\n}\n\n// TLSMinVersion returns the golang TLS version from the version string passed.\nfunc TLSMinVersion(version string) (uint16, error) {\n\tswitch version {\n\tcase TLSMinVersion1_2:\n\t\treturn tls.VersionTLS12, nil\n\tcase TLSMinVersion1_3:\n\t\treturn tls.VersionTLS13, nil\n\tdefault:\n\t\treturn tls.VersionTLS12, fmt.Errorf(\"minimum TLS version: %s is not supported. Only %s and %s are supported\", version, TLSMinVersion1_2, TLSMinVersion1_3)\n\t}\n}\n","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/pilot/pkg/bootstrap/options.go#L173-L209","documentation":"TLSCipherSuites (pilot/pkg/bootstrap/options.go) maps each name from --tlsCipherSuites to a numeric ID using the allCiphers table, whose keys are Go crypto/tls cipher names. A name not present in the table aborts istiod startup with this error.","triggerScenarios":"Passing an OpenSSL/IETF-style name (ECDHE-RSA-AES128-GCM-SHA256) instead of the Go name (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256); a typo or wrong case in the flag; referencing a cipher removed in newer istio/Go releases (e.g. CBC or 3DES suites).","commonSituations":"Translating cipher lists from nginx/Envoy docs into istiod flags; copy-pasting from OpenSSL configs; upgrading istio or its Go toolchain and old flagged ciphers no longer exist.","solutions":["Use exact Go crypto/tls constant names, e.g. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256","List supported names from tls.CipherSuites()/tls.InsecureCipherSuites() or inspect allCiphers() in pilot/pkg/bootstrap/options.go","Remove the offending suite from --tlsCipherSuites","After upgrading istio/Go, re-validate every suite in the flag"],"exampleFix":"# before: OpenSSL-style name -> \"cipher suite ECDHE-RSA-AES128-GCM-SHA256 not supported or doesn't exist\"\nistiod --tlsCipherSuites=ECDHE-RSA-AES128-GCM-SHA256,ECDHE-RSA-AES256-GCM-SHA384\n\n# after: Go crypto/tls names\nistiod --tlsCipherSuites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","handlingStrategy":"validation","validationCode":"// Validate cipher names against Go's supported set before passing the flag\nvalid := map[string]bool{}\nfor _, cs := range tls.CipherSuites() { valid[cs.Name] = true }\nfor _, n := range cipherNames {\n    if !valid[n] { return fmt.Errorf(\"cipher suite %s not supported or doesn't exist\", n) }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use exact Go crypto/tls cipher names (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256), not OpenSSL/IETF strings","Re-validate the cipher list after every istio or Go upgrade","Prefer omitting --tlsCipherSuites to accept secure defaults"],"tags":["istiod","tls","security","configuration","startup"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}