{"record":{"id":"67ffeedc9589736d","repo":"nats-io/nats-server","slug":"unsupported-tls-version-s","errorCode":null,"errorMessage":"unsupported TLS version: %s","messagePattern":"unsupported TLS version: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/opts.go","lineNumber":5119,"sourceCode":"\t\treturn 0, fmt.Errorf(\"unrecognized curve preference %s\", curveName)\n\t}\n\treturn curve, nil\n}\n\nfunc parseTLSVersion(v any) (uint16, error) {\n\tvar tlsVersionNumber uint16\n\tswitch v := v.(type) {\n\tcase string:\n\t\tn, err := tlsVersionFromString(v)\n\t\tif err != nil {\n\t\t\treturn 0, err\n\t\t}\n\t\ttlsVersionNumber = n\n\tdefault:\n\t\treturn 0, fmt.Errorf(\"'min_version' wrong type: %v\", v)\n\t}\n\tif tlsVersionNumber < tls.VersionTLS12 {\n\t\treturn 0, fmt.Errorf(\"unsupported TLS version: %s\", tls.VersionName(tlsVersionNumber))\n\t}\n\treturn tlsVersionNumber, nil\n}\n\n// Helper function to parse TLS configs.\nfunc parseTLS(v any, isClientCtx bool) (t *TLSConfigOpts, retErr error) {\n\tvar (\n\t\ttlsm map[string]any\n\t\ttc   = TLSConfigOpts{}\n\t\tlt   token\n\t\tics  []*tls.CipherSuite // Insecure ciphers found\n\t)\n\tdefer convertPanicToError(&lt, &retErr)\n\n\ttk, v := unwrapValue(v, &lt)\n\ttlsm = v.(map[string]any)\n\tfor mk, mv := range tlsm {\n\t\ttk, mv := unwrapValue(mv, &lt)","sourceCodeStart":5101,"sourceCodeEnd":5137,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/opts.go#L5101-L5137","documentation":"After resolving the TLS version number, parseTLSVersion enforces a floor of tls.VersionTLS12. This error means the configured minimum TLS version is below TLS 1.2 (e.g. TLS 1.0/1.1), which the NATS server refuses for security reasons.","triggerScenarios":"Configuring min_version to \"1.0\" or \"1.1\" (or the corresponding numeric constants) in a TLS options block.","commonSituations":"Migrating old configs that supported legacy clients; security scanners aside, NATS requires >=1.2; environment where compliance policy still asked for TLS 1.0.","solutions":["Change min_version to \"1.2\" or \"1.3\"","Upgrade legacy clients to support TLS 1.2+","Remove the min_version override to use defaults"],"exampleFix":"// before\nmin_version: \"1.1\"\n// after\nmin_version: \"1.2\"","handlingStrategy":"validation","validationCode":"if cfg.MinVersion != \"\" && cfg.MinVersion != \"1.2\" && cfg.MinVersion != \"1.3\" {\n  return fmt.Errorf(\"min_version %q unsupported; use 1.2 or 1.3\", cfg.MinVersion)\n}","typeGuard":null,"tryCatchPattern":"if err := checkTLSFloor(cfg.TLS.MinVersion); err != nil { log.Fatalf(\"%v\", err) }","preventionTips":["Treat TLS 1.2 as the minimum everywhere","Upgrade or retire legacy clients instead of lowering floor","Audit configs with a security scanner that flags <1.2"],"tags":["tls","config-validation","security"],"backgroundTag":"unsupported-tls-version","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}