{"record":{"id":"71bf51569a63ca8a","repo":"denoland/deno","slug":"err-tls-invalid-protocol-method","errorCode":"ERR_TLS_INVALID_PROTOCOL_METHOD","errorMessage":"SSLv2 methods disabled","messagePattern":"SSLv2 methods disabled","errorType":"exception","errorClass":"NodeTypeError","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/_tls_common.ts","lineNumber":310,"sourceCode":"\n  if (options.secureProtocol) {\n    // If secureProtocol is set, minVersion/maxVersion must not also be set.\n    // Node raises this conflict before validating the protocol method string.\n    if (options.minVersion || options.maxVersion) {\n      throw new ERR_TLS_PROTOCOL_VERSION_CONFLICT(\n        options.minVersion || options.maxVersion,\n        \"secureProtocol\",\n      );\n    }\n\n    const range = kProtocolMap[options.secureProtocol];\n    if (!range) {\n      if (\n        options.secureProtocol === \"SSLv2_method\" ||\n        options.secureProtocol === \"SSLv2_client_method\" ||\n        options.secureProtocol === \"SSLv2_server_method\"\n      ) {\n        throw new ERR_TLS_INVALID_PROTOCOL_METHOD(\"SSLv2 methods disabled\");\n      }\n      if (\n        options.secureProtocol === \"SSLv3_method\" ||\n        options.secureProtocol === \"SSLv3_client_method\" ||\n        options.secureProtocol === \"SSLv3_server_method\"\n      ) {\n        throw new ERR_TLS_INVALID_PROTOCOL_METHOD(\"SSLv3 methods disabled\");\n      }\n      throw new ERR_TLS_INVALID_PROTOCOL_METHOD(\n        `Unknown method: ${options.secureProtocol}`,\n      );\n    }\n\n    minVersion = range[0];\n    maxVersion = range[1];\n  } else {\n    if (options.minVersion) {\n      if (!SetPrototypeHas(kValidVersions, options.minVersion)) {","sourceCodeStart":292,"sourceCodeEnd":328,"githubUrl":"https://github.com/denoland/deno/blob/89f33cbef296a2b287f323d42de54c871fa69c77/ext/node/polyfills/_tls_common.ts#L292-L328","documentation":"Inside getProtocolRange, when secureProtocol names no entry in kProtocolMap the disabled families are checked first: SSLv2_method, SSLv2_client_method, and SSLv2_server_method all throw ERR_TLS_INVALID_PROTOCOL_METHOD('SSLv2 methods disabled'). SSLv2 has fundamental protocol flaws and is compiled out of modern TLS backends, so selecting it explicitly is always an error.","triggerScenarios":"tls.connect({ host, secureProtocol: 'SSLv2_method' }); https.createServer({ secureProtocol: 'SSLv2_server_method' }); any legacy config or tutorial value that pins SSLv2.","commonSituations":"Decade-old connection code kept alive in a corner of the codebase; legacy device integrations that once required SSLv2; config files migrated verbatim between projects.","solutions":["Switch to minVersion: 'TLSv1.2' (or 'TLSv1.3')","Or use a supported method string such as 'TLSv1_2_method'","Grep configs and docs for SSLv2 method names and remove them","If a peer truly only speaks SSLv2, isolate or replace it - it cannot be reached securely"],"exampleFix":"// before\nconst socket = tls.connect({ host, secureProtocol: 'SSLv2_method' });\n\n// after\nconst socket = tls.connect({ host, minVersion: 'TLSv1.2' });","handlingStrategy":"validation","validationCode":"const DISABLED_METHODS = [\n  'SSLv2_method', 'SSLv2_client_method', 'SSLv2_server_method',\n  'SSLv3_method', 'SSLv3_client_method', 'SSLv3_server_method',\n];\nif (DISABLED_METHODS.includes(opts.secureProtocol)) {\n  delete opts.secureProtocol;\n  opts.minVersion ??= 'TLSv1.2';\n}","typeGuard":null,"tryCatchPattern":"try {\n  tls.connect(opts);\n} catch (e) {\n  if (e.code === 'ERR_TLS_INVALID_PROTOCOL_METHOD' && /SSLv2/.test(e.message)) {\n    const { secureProtocol, ...rest } = opts;\n    tls.connect({ ...rest, minVersion: 'TLSv1.2' });\n  } else throw e;\n}","preventionTips":["Grep configs for SSLv2/SSLv3 method strings during dependency upgrades","Enforce a minimum TLS version in code review checklists","Validate secureProtocol against a known-methods whitelist at startup"],"tags":["tls","security","deprecated","node-compat"],"backgroundTag":null,"analyzedSha":"89f33cbef296a2b287f323d42de54c871fa69c77","analyzedAt":"2026-08-16T07:54:21.310Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}