{"record":{"id":"754e6f3375a92cdf","repo":"nats-io/nats-server","slug":"unsupported-minimum-tls-version-s","errorCode":null,"errorMessage":"unsupported minimum TLS version: %s","messagePattern":"unsupported minimum TLS version: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/opts.go","lineNumber":5890,"sourceCode":"\t\tconfig.ClientAuth = tls.RequireAndVerifyClientCert\n\t}\n\t// Add in CAs if applicable.\n\tif tc.CaFile != _EMPTY_ {\n\t\trootPEM, err := os.ReadFile(tc.CaFile)\n\t\tif err != nil || rootPEM == nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tpool := x509.NewCertPool()\n\t\tok := pool.AppendCertsFromPEM(rootPEM)\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse root ca certificate\")\n\t\t}\n\t\tconfig.ClientCAs = pool\n\t}\n\t// Allow setting TLS minimum version.\n\tif tc.MinVersion > 0 {\n\t\tif tc.MinVersion < tls.VersionTLS12 {\n\t\t\treturn nil, fmt.Errorf(\"unsupported minimum TLS version: %s\", tls.VersionName(tc.MinVersion))\n\t\t}\n\t\tconfig.MinVersion = tc.MinVersion\n\t}\n\n\treturn &config, nil\n}\n\n// MergeOptions will merge two options giving preference to the flagOpts\n// if the item is present.\nfunc MergeOptions(fileOpts, flagOpts *Options) *Options {\n\tif fileOpts == nil {\n\t\treturn flagOpts\n\t}\n\tif flagOpts == nil {\n\t\treturn fileOpts\n\t}\n\t// Merge the two, flagOpts override\n\topts := *fileOpts","sourceCodeStart":5872,"sourceCodeEnd":5908,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/opts.go#L5872-L5908","documentation":"The server rejects a configured TLS MinVersion below TLS 1.2. NATS enforces 1.2 as the minimum acceptable protocol floor; any lower constant (TLS 1.0/1.1) in the config makes TLS config construction fail before the server starts.","triggerScenarios":"Setting the min_version option in a TLS config block to a value below tls.VersionTLS12 (e.g. 0x0301 for TLS 1.1, or a hand-written decimal in JSON/YAML config).","commonSituations":"Copied legacy config from an old NATS server (pre-2.x allowed lower versions), manually specifying the numeric version constant incorrectly, or trying to interoperate with ancient clients still on TLS 1.1.","solutions":["Set min_version to \"TLS1.2\" (or remove the option to use the default).","If the version is supplied programmatically, pass tls.VersionTLS12 or higher only.","Upgrade legacy clients to support TLS 1.2+ instead of lowering the server floor.","Check the config value type/spelling for the version constant."],"exampleFix":"// before\ntls: { min_version: \"TLS1.1\" }\n// after\ntls: { min_version: \"TLS1.2\" }","handlingStrategy":"validation","validationCode":"// Reject sub-TLS1.2 min_version in config before applying it\nif tc.MinVersion > 0 && tc.MinVersion < tls.VersionTLS12 {\n    return fmt.Errorf(\"min_version must be TLS1.2 or higher, got %s\", tls.VersionName(tc.MinVersion))\n}","typeGuard":"func minVersionSupported(v uint16) bool {\n    return v == 0 || v >= tls.VersionTLS12\n}","tryCatchPattern":"if err := checkTLSConfig(tc); err != nil {\n    return fmt.Errorf(\"fix tls.min_version in config: %w\", err)\n}","preventionTips":["Use the symbolic value \"TLS1.2\"/tls.VersionTLS12 rather than raw numbers.","Update legacy configs when upgrading NATS server to >= 2.x.","Upgrade old clients instead of lowering the server's protocol floor."],"tags":["tls","config","protocol-version"],"backgroundTag":"tls-version-too-low","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}