{"record":{"id":"68401507a8a2e624","repo":"cloudflare/cloudflared","slug":"invalid-protocol-selected-s","errorCode":null,"errorMessage":"invalid protocol selected: %s","messagePattern":"invalid protocol selected: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"supervisor/tunnel.go","lineNumber":499,"sourceCode":"\t\t// Rebuild the connection options with the local address now that the\n\t\t// edge socket is established.\n\t\t// nolint: gosec\n\t\tconnOptions := e.config.connectionOptions(edgeConn.LocalAddr().String(), uint8(backoff.Retries()))\n\t\t// nolint: zerologlint\n\t\tconnOptions.LogFields(connLog.Logger().Debug().Uint8(connection.LogFieldConnIndex, connIndex)).Msgf(\"Tunnel connection options\")\n\t\tif err := e.serveHTTP2(\n\t\t\tctx,\n\t\t\tconnLog,\n\t\t\tedgeConn,\n\t\t\tconnOptions,\n\t\t\tcontrolStream,\n\t\t\tconnIndex,\n\t\t); err != nil {\n\t\t\treturn err, false\n\t\t}\n\n\tdefault:\n\t\treturn fmt.Errorf(\"invalid protocol selected: %s\", protocol), false\n\t}\n\treturn\n}\n\ntype unrecoverableError struct {\n\terr error\n}\n\nfunc (r unrecoverableError) Error() string {\n\treturn r.err.Error()\n}\n\nfunc (e *EdgeTunnelServer) serveHTTP2(\n\tctx context.Context,\n\tconnLog *ConnAwareLogger,\n\ttlsServerConn net.Conn,\n\tconnOptions *client.ConnectionOptionsSnapshot,\n\tcontrolStreamHandler connection.ControlStreamHandler,","sourceCodeStart":481,"sourceCodeEnd":517,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/supervisor/tunnel.go#L481-L517","documentation":"serveConnection switches on the negotiated transport protocol (QUIC, HTTP2, ...). If the protocol value is anything else — a corrupted config, an unknown future enum, or a programmer error — the default branch rejects it as 'invalid protocol selected: %s' as unrecoverable, since retrying with the same invalid protocol cannot succeed.","triggerScenarios":"The resolved protocol from config/CLI (--protocol) or edge negotiation holds a value outside the known set (e.g. hand-edited config file with `protocol: tcp`, stale flag parsing, or a binary older than a newly introduced protocol returned by remote config).","commonSituations":"Typoed --protocol flag value; stale/foreign config file entries under tunnel credentials/remote configuration; mixed-version environments where edge assigns a protocol this binary does not know.","solutions":["Check the --protocol flag and config file: valid values are quic, http2, or auto.","Remove or fix the invalid protocol entry and re-run with `--protocol auto` to let cloudflared negotiate.","Upgrade cloudflared if the edge is assigning a protocol your binary predates.","Validate the tunnel config JSON/YAML for stray or renamed fields under protocol selection."],"exampleFix":"// before\ncloudflared tunnel run --protocol h3 my-tunnel\n// after\ncloudflared tunnel run --protocol auto my-tunnel","handlingStrategy":"try-catch","validationCode":"// at startup: verify the base config exists before serving\nif e.config.EdgeTLSConfigs[connection.HTTP2] == nil {\n\treturn errors.New(\"HTTP2 edge TLS config was not initialized\")\n}","typeGuard":null,"tryCatchPattern":"tlsConfig, err := cfdcrypto.TLSConfigWithCurvePreferences(e.config.EdgeTLSConfigs[protocol], pqMode)\nif err != nil {\n\tlog.Error().Err(err).Msg(\"TLS config build failed; will retry\")\n\treturn fmt.Errorf(\"could not create TLS configuration: %w\", err), true\n}","preventionTips":["Fix any CA-pool/credential initialization errors reported at startup before debugging this error.","Keep cloudflared current when using --post-quantum.","Avoid pinning --protocol http2 if the environment keeps failing; allow auto fallback to QUIC."],"tags":["protocol","configuration","cli"],"backgroundTag":"invalid-enum-value","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}