{"record":{"id":"532edbcc12541080","repo":"elastic/elasticsearch","slug":"could-not-resolve-ssl-client-verification-mode-un","errorCode":null,"errorMessage":"could not resolve ssl client verification mode, unknown value [{}], recognised values are [{}]","messagePattern":"could not resolve ssl client verification mode, unknown value \\[(.+?)\\], recognised values are \\[(.+?)\\]","errorType":"exception","errorClass":"SslConfigException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslVerificationMode.java","lineNumber":88,"sourceCode":"     * @return true if certificate verification is enabled\n     */\n    public abstract boolean isCertificateVerificationEnabled();\n\n    private static final Map<String, SslVerificationMode> LOOKUP = Collections.unmodifiableMap(buildLookup());\n\n    private static Map<String, SslVerificationMode> buildLookup() {\n        Map<String, SslVerificationMode> map = new LinkedHashMap<>(3);\n        map.put(\"none\", NONE);\n        map.put(\"certificate\", CERTIFICATE);\n        map.put(\"full\", FULL);\n        return map;\n    }\n\n    public static SslVerificationMode parse(String value) {\n        final SslVerificationMode mode = LOOKUP.get(value.toLowerCase(Locale.ROOT));\n        if (mode == null) {\n            final String allowedValues = String.join(\",\", LOOKUP.keySet());\n            throw new SslConfigException(\n                \"could not resolve ssl client verification mode, unknown value [\"\n                    + value\n                    + \"], recognised values are [\"\n                    + allowedValues\n                    + \"]\"\n            );\n        }\n        return mode;\n    }\n}\n","sourceCodeStart":70,"sourceCodeEnd":99,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslVerificationMode.java#L70-L99","documentation":"Thrown by SslVerificationMode.parse when resolving an SSL client verification mode string. The parser lowercases the input and looks it up in a fixed map of three keys: none, certificate, full. Any value that does not match one of those three (case-insensitively) raises an SslConfigException listing the allowed values.","triggerScenarios":"Calling SslVerificationMode.parse(value) with a string outside {none, certificate, full}. This is the resolver behind the ssl.verification_mode / xpack.security.transport.ssl.verification_mode settings used when configuring mutual TLS on transport or http.","commonSituations":"A typo in elasticsearch.yml (e.g. verification_mode: ful, peer, true, off, optional); migrating from another product's vocabulary that uses peer/require/request; copy-pasting a setting that another SSL library accepts but this lookup does not.","solutions":["Set the verification_mode setting to exactly one of: none, certificate, or full","Check the value in the error's [unknown value] field for typos, stray whitespace, or quotes","If migrating from a config that uses peer or require, map it to full (both hostname and certificate checked)"],"exampleFix":"// before\nxpack.security.http.ssl.verification_mode: peer\n// after\nxpack.security.http.ssl.verification_mode: full","handlingStrategy":"validation","validationCode":"private static final Set<String> SSL_MODES = Set.of(\"none\", \"certificate\", \"full\");\nString v = raw == null ? null : raw.trim().toLowerCase(Locale.ROOT);\nif (v == null || !SSL_MODES.contains(v)) {\n    throw new IllegalArgumentException(\"Invalid ssl verification_mode: \" + raw);\n}\nSslVerificationMode mode = SslVerificationMode.parse(v);","typeGuard":"static boolean isSslVerificationMode(String s) {\n    if (s == null) return false;\n    return Set.of(\"none\", \"certificate\", \"full\").contains(s.trim().toLowerCase(Locale.ROOT));\n}","tryCatchPattern":"try {\n    SslVerificationMode mode = SslVerificationMode.parse(value);\n} catch (SslConfigException e) {\n    // surface to config validation; do not fall back silently\n    throw new ConfigException(\"Invalid setting ssl.verification_mode=\" + value, e);\n}","preventionTips":["Keep an allowlist constant next to the config parser","Run config through a validator at load time, not at first SSL handshake","Treat the recognised-values list in the error as authoritative"],"tags":["ssl","config","security","mtls","startup"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}