{"record":{"id":"797ba7421102eb82","repo":"hashicorp/nomad","slug":"unsupported-tls-version-q","errorCode":null,"errorMessage":"unsupported TLS version %q","messagePattern":"unsupported TLS version %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"helper/tlsutil/config.go","lineNumber":459,"sourceCode":"\tswitch privKey.(type) {\n\tcase *rsa.PrivateKey:\n\t\treturn rsaStringRepr, nil\n\tcase *ecdsa.PrivateKey:\n\t\treturn ecdsaStringRepr, nil\n\tdefault:\n\t\treturn \"\", fmt.Errorf(\"Unsupported signature algorithm %T; RSA and ECDSA only are supported.\", privKey)\n\t}\n}\n\n// ParseMinVersion parses the specified minimum TLS version for the Nomad agent\nfunc ParseMinVersion(version string) (uint16, error) {\n\tif version == \"\" {\n\t\treturn supportedTLSVersions[\"tls12\"], nil\n\t}\n\n\tvers, ok := supportedTLSVersions[version]\n\tif !ok {\n\t\treturn 0, fmt.Errorf(\"unsupported TLS version %q\", version)\n\t}\n\n\treturn vers, nil\n}\n\n// ShouldReloadRPCConnections compares two TLS Configurations and determines\n// whether they differ such that RPC connections should be reloaded\nfunc ShouldReloadRPCConnections(old, new *config.TLSConfig) (bool, error) {\n\tvar certificateInfoEqual bool\n\tvar rpcInfoEqual bool\n\n\t// If already configured with TLS, compare with the new TLS configuration\n\tif new != nil {\n\t\tvar err error\n\t\tcertificateInfoEqual, err = new.CertificateInfoIsEqual(old)\n\t\tif err != nil {\n\t\t\treturn false, err\n\t\t}","sourceCodeStart":441,"sourceCodeEnd":477,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/helper/tlsutil/config.go#L441-L477","documentation":"ParseMinVersion maps a TLS version string (e.g. \"tls10\", \"tls11\", \"tls12\", \"tls13\") to the corresponding constant using supportedTLSVersions. An unknown string yields this error. An empty version defaults to tls12.","triggerScenarios":"Calling ParseMinVersion (via NewTLSConfiguration) with a tls_min_version value not in supportedTLSVersions, such as \"TLS1.2\", \"1.3\", or \"tlsv1.3\".","commonSituations":"Writing the version with wrong casing/format in the agent config; configs written for other products that accept \"1.2\"-style values; typo like \"tls_12\".","solutions":["Use the exact accepted strings: tls10, tls11, tls12, or tls13 (e.g. tls_min_version = \"tls12\").","Remove tls_min_version to get the tls12 default.","Check supportedTLSVersions in helper/tlsutil/config.go for the exact keys."],"exampleFix":"// before\ntls_min_version = \"TLS1.2\"\n// after\ntls_min_version = \"tls12\"","handlingStrategy":"validation","validationCode":"valid := map[string]bool{\"tls10\": true, \"tls11\": true, \"tls12\": true, \"tls13\": true}\nif v != \"\" && !valid[strings.ToLower(v)] {\n    return fmt.Errorf(\"tls_min_version %q invalid; use tls10|tls11|tls12|tls13\", v)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use exact version strings: tls10, tls11, tls12, tls13.","Lint agent config before deploy.","Omit tls_min_version unless a specific floor is required."],"tags":["tls","configuration","version"],"backgroundTag":"unsupported-tls-version","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}