{"record":{"id":"7e9793a5d826c8f1","repo":"tailscale/tailscale","slug":"control-server-is-too-old-no-noise-key","errorCode":null,"errorMessage":"control server is too old; no noise key","messagePattern":"control server is too old; no noise key","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"control/controlclient/direct.go","lineNumber":689,"sourceCode":"\t\t\treturn regen, opt.URL, nil, err\n\t\t}\n\t\tc.logf(\"control server key from %s: ts2021=%s, legacy=%v\", c.serverURL, keys.PublicKey.ShortString(), keys.LegacyPublicKey.ShortString())\n\n\t\tc.mu.Lock()\n\t\tc.serverLegacyKey = keys.LegacyPublicKey\n\t\tc.serverNoiseKey = keys.PublicKey\n\t\tc.mu.Unlock()\n\t\tserverKey = keys.LegacyPublicKey\n\t\tserverNoiseKey = keys.PublicKey\n\n\t\t// Proactively shut down our TLS TCP connection.\n\t\t// We're not going to need it and it's nicer to the\n\t\t// server.\n\t\tc.httpc.CloseIdleConnections()\n\t}\n\n\tif serverNoiseKey.IsZero() {\n\t\treturn false, \"\", nil, errors.New(\"control server is too old; no noise key\")\n\t}\n\n\tvar oldNodeKey key.NodePublic\n\tswitch {\n\tcase opt.Logout:\n\t\ttryingNewKey = persist.PrivateNodeKey\n\tcase opt.URL != \"\":\n\t\t// Nothing.\n\tcase regen || persist.PrivateNodeKey.IsZero():\n\t\tc.logf(\"Generating a new nodekey.\")\n\t\tpersist.OldPrivateNodeKey = persist.PrivateNodeKey\n\t\ttryingNewKey = key.NewNode()\n\tdefault:\n\t\t// Try refreshing the current key first\n\t\ttryingNewKey = persist.PrivateNodeKey\n\t}\n\tif !persist.OldPrivateNodeKey.IsZero() {\n\t\toldNodeKey = persist.OldPrivateNodeKey.Public()","sourceCodeStart":671,"sourceCodeEnd":707,"githubUrl":"https://github.com/tailscale/tailscale/blob/5201273aec737d6372ab7423c31c04ca3ca2a0c2/control/controlclient/direct.go#L671-L707","documentation":"Returned by controlclient's key bootstrap when, after fetching /key, the server advertised no ts2021 Noise public key (serverNoiseKey.IsZero()). It means the configured control server predates ts2021 Noise transport and cannot carry out a modern Noise connection.","triggerScenarios":"Thrown at control/controlclient/direct.go:731 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Point the client at a control server running a version that supports ts2021 (Noise) keys","Force the legacy TLS transport if the deployment intentionally runs an old control server","Verify the control URL is not a broken proxy that strips the ts2021 key from the key response"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5201273aec737d6372ab7423c31c04ca3ca2a0c2","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}