{"record":{"id":"8381184a614b2bf0","repo":"AdguardTeam/AdGuardHome","slug":"override-tls-ciphers-w","errorCode":null,"errorMessage":"override_tls_ciphers: %w","messagePattern":"override_tls_ciphers: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/home/config.go","lineNumber":936,"sourceCode":"\t}\n\n\terr = maybe.WriteFile(confPath, buf.Bytes(), aghos.DefaultPermFile)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"writing config file: %w\", err)\n\t}\n\n\treturn nil\n}\n\n// validateTLSCipherIDs validates the custom TLS cipher suite IDs.\nfunc validateTLSCipherIDs(cipherIDs []string) (err error) {\n\tif len(cipherIDs) == 0 {\n\t\treturn nil\n\t}\n\n\t_, err = aghtls.ParseCiphers(cipherIDs)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"override_tls_ciphers: %w\", err)\n\t}\n\n\treturn nil\n}\n\n// defaultConfigModifier is a default [agh.ConfigModifier] implementation.\ntype defaultConfigModifier struct {\n\tauth     *auth\n\tconfig   *configuration\n\tlogger   *slog.Logger\n\ttlsMgr   aghtls.Manager\n\tworkDir  string\n\tconfPath string\n}\n\n// newDefaultConfigModifier returns the new properly initialized\n// *defaultConfigModifier.  All arguments must not be nil.\n//","sourceCodeStart":918,"sourceCodeEnd":954,"githubUrl":"https://github.com/AdguardTeam/AdGuardHome/blob/b41aefbe51c8dde65e2c50f093996afa0502edf9/internal/home/config.go#L918-L954","documentation":"Validation of the tls.override_tls_ciphers config field failed: aghtls.ParseCiphers could not map the configured cipher suite names/IDs to real TLS ciphers.","triggerScenarios":"Config containing tls.cipher_ids with unknown or unsupported cipher names/IDs for the Go crypto/tls version in use.","commonSituations":"Copying cipher lists from OpenSSL/nginx configs with different naming (e.g. ECDHE-RSA vs Go names), removed/deprecated ciphers, typos, or ciphers unavailable in newer Go releases.","solutions":["Remove or correct entries in tls.override_tls_ciphers to use cipher names supported by Go's crypto/tls","Consult Go's crypto/tls documentation for valid cipher suite names in your build","Drop the override entirely to use sane defaults unless specifically required"],"exampleFix":"# before\ncipher_ids: [TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256_X]\n# after\ncipher_ids: [TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]","handlingStrategy":"validation","validationCode":"// Validate against Go's supported suites before applying\nfor _, id := range cipherIDs {\n    if tls.CipherSuiteByName(id) == nil { return fmt.Errorf(\"unknown cipher %q\", id) }\n}","typeGuard":null,"tryCatchPattern":"// Drop override and retry with defaults\nif isCipherErr(err) { cfg.TLS.CipherIDs = nil; reapply() }","preventionTips":["Use Go crypto/tls cipher names, not OpenSSL strings","Prefer default cipher suites unless compliance requires overrides"],"tags":["config","tls","ciphers","validation"],"backgroundTag":"tls-cipher-configuration-invalid","analyzedSha":"b41aefbe51c8dde65e2c50f093996afa0502edf9","analyzedAt":"2026-08-27T04:57:55.097Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}