{"record":{"id":"54393be1959207cb","repo":"elastic/elasticsearch","slug":"cannot-configure-ssl-tls-without-any-supported-pro","errorCode":null,"errorMessage":"cannot configure SSL/TLS without any supported protocols","messagePattern":"cannot configure SSL/TLS without any supported protocols","errorType":"exception","errorClass":"SslConfigException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfiguration.java","lineNumber":84,"sourceCode":"\n    public SslConfiguration(\n        String settingPrefix,\n        boolean explicitlyConfigured,\n        SslTrustConfig trustConfig,\n        SslKeyConfig keyConfig,\n        SslVerificationMode verificationMode,\n        SslClientAuthenticationMode clientAuth,\n        List<String> ciphers,\n        List<String> supportedProtocols,\n        long handshakeTimeoutMillis\n    ) {\n        this.settingPrefix = settingPrefix;\n        this.explicitlyConfigured = explicitlyConfigured;\n        if (ciphers == null || ciphers.isEmpty()) {\n            throw new SslConfigException(\"cannot configure SSL/TLS without any supported cipher suites\");\n        }\n        if (supportedProtocols == null || supportedProtocols.isEmpty()) {\n            throw new SslConfigException(\"cannot configure SSL/TLS without any supported protocols\");\n        }\n        this.trustConfig = Objects.requireNonNull(trustConfig, \"trust config cannot be null\");\n        this.keyConfig = Objects.requireNonNull(keyConfig, \"key config cannot be null\");\n        this.verificationMode = Objects.requireNonNull(verificationMode, \"verification mode cannot be null\");\n        this.clientAuth = Objects.requireNonNull(clientAuth, \"client authentication cannot be null\");\n        if (handshakeTimeoutMillis < 1L) {\n            throw new SslConfigException(\"handshake timeout must be at least 1ms\");\n        }\n        this.handshakeTimeoutMillis = handshakeTimeoutMillis;\n        this.ciphers = Collections.unmodifiableList(ciphers);\n        this.supportedProtocols = Collections.unmodifiableList(supportedProtocols);\n    }\n\n    public List<String> getCipherSuites() {\n        return ciphers;\n    }\n\n    /**","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfiguration.java#L66-L102","documentation":"Sibling check to the cipher precondition: SslConfiguration requires a non-null, non-empty list of supported protocols. Without protocols the SSLContext cannot be initialised with a usable algorithm.","triggerScenarios":"Constructing SslConfiguration with supportedProtocols=null or supportedProtocols=[]. Like 822, the loader's own empty-check (error 829) usually fires first when settings are the source.","commonSituations":"Programmatic construction with an empty protocols list; a custom loader subclass that nulls out DEFAULT_PROTOCOLS; test fixtures that forget to set protocols.","solutions":["Pass a non-empty protocols list — typically TLSv1.2 and TLSv1.3 (SslConfigurationLoader.DEFAULT_PROTOCOLS).","If loading from settings, remove the empty ssl.supported_protocols override so defaults apply.","In custom loaders, always fall back to DEFAULT_PROTOCOLS rather than returning empty."],"exampleFix":"// before\nnew SslConfiguration(prefix, true, trust, key, mode, auth,\n    ciphers, List.of(), 10_000L); // empty protocols\n// after\nnew SslConfiguration(prefix, true, trust, key, mode, auth,\n    ciphers, List.of(\"TLSv1.2\",\"TLSv1.3\"), 10_000L);","handlingStrategy":"validation","validationCode":"List<String> ensureProtocols(List<String> protocols) {\n    if (protocols == null || protocols.isEmpty())\n        return SslConfigurationLoader.DEFAULT_PROTOCOLS;\n    return protocols;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always default to SslConfigurationLoader.DEFAULT_PROTOCOLS in programmatic construction.","Never construct SslConfiguration with an empty protocols list.","Test custom loaders with null/empty inputs."],"tags":["ssl","config","protocols","validation"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}