{"record":{"id":"6ed4f8c33dd2caa8","repo":"elastic/elasticsearch","slug":"no-protocols-configured-in","errorCode":null,"errorMessage":"no protocols configured in [{}]","messagePattern":"no protocols configured in \\[(.+?)\\]","errorType":"exception","errorClass":"SslConfigException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfigurationLoader.java","lineNumber":319,"sourceCode":"        final List<String> ciphers = resolveListSetting(CIPHERS, Function.identity(), defaultCiphers);\n        final SslVerificationMode verificationMode = resolveSetting(VERIFICATION_MODE, SslVerificationMode::parse, defaultVerificationMode);\n        final SslClientAuthenticationMode clientAuth = resolveSetting(CLIENT_AUTH, SslClientAuthenticationMode::parse, defaultClientAuth);\n        final List<X509Field> trustRestrictionsX509Fields = resolveListSetting(\n            TRUST_RESTRICTIONS_X509_FIELDS,\n            X509Field::parseForRestrictedTrust,\n            defaultRestrictedTrustFields\n        );\n        final long handshakeTimeoutMillis = resolveSetting(\n            HANDSHAKE_TIMEOUT,\n            s -> TimeValue.parseTimeValue(s, HANDSHAKE_TIMEOUT),\n            DEFAULT_HANDSHAKE_TIMEOUT\n        ).millis();\n\n        final SslKeyConfig keyConfig = buildKeyConfig(basePath);\n        final SslTrustConfig trustConfig = buildTrustConfig(basePath, verificationMode, keyConfig, Set.copyOf(trustRestrictionsX509Fields));\n\n        if (protocols == null || protocols.isEmpty()) {\n            throw new SslConfigException(\"no protocols configured in [\" + settingPrefix + PROTOCOLS + \"]\");\n        }\n        if (ciphers == null || ciphers.isEmpty()) {\n            throw new SslConfigException(\"no cipher suites configured in [\" + settingPrefix + CIPHERS + \"]\");\n        }\n        final boolean isExplicitlyConfigured = hasSettings(settingPrefix);\n        return new SslConfiguration(\n            settingPrefix,\n            isExplicitlyConfigured,\n            trustConfig,\n            keyConfig,\n            verificationMode,\n            clientAuth,\n            ciphers,\n            protocols,\n            handshakeTimeoutMillis\n        );\n    }\n","sourceCodeStart":301,"sourceCodeEnd":337,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfigurationLoader.java#L301-L337","documentation":"After resolving protocols from settings (with defaults), the loader checks that the resolved list is non-null and non-empty before constructing SslConfiguration. The error message echoes the full setting key (prefix + \"supported_protocols\") so the operator knows which key to fix.","triggerScenarios":"ssl.supported_protocols is explicitly set to an empty list (e.g. supported_protocols: []), or the resolver returns null because a custom loader subclass overrode DEFAULT_PROTOCOLS to null.","commonSituations":"YAML/JSON config with supported_protocols: [] intended to disable TLS; misconfigured Helm chart rendering an empty array; environment-specific override that blanks the list.","solutions":["Remove the empty supported_protocols setting so DEFAULT_PROTOCOLS (TLSv1.2/TLSv1.3) applies.","Populate the list with at least one valid protocol: supported_protocols: [\"TLSv1.2\",\"TLSv1.3\"].","Audit Helm/Ansible templates for conditional blocks that can render an empty array."],"exampleFix":"# before\nxpack.security.http.ssl.supported_protocols: []\n# after (omit, or set explicitly)\nxpack.security.http.ssl.supported_protocols: [ \"TLSv1.2\", \"TLSv1.3\" ]","handlingStrategy":"validation","validationCode":"List<String> resolveProtocolsSafely(SslConfigurationLoader loader) {\n    List<String> p = loader.resolveListSetting(\"supported_protocols\", Function.identity(), SslConfigurationLoader.DEFAULT_PROTOCOLS);\n    if (p == null || p.isEmpty()) return SslConfigurationLoader.DEFAULT_PROTOCOLS;\n    return p;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never set supported_protocols to an empty list; omit it to use defaults.","Lint rendered config (Helm/Ansible) for empty array values under ssl.*.","Pre-flight check elasticsearch.yml with a parser that flags empty list values."],"tags":["ssl","config","protocols","validation"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}