{"record":{"id":"bcee33d90ab45c3c","repo":"elastic/elasticsearch","slug":"could-not-resolve-ssl-client-authentication-unkno","errorCode":null,"errorMessage":"could not resolve ssl client authentication, unknown value [{}], recognised values are [{}]","messagePattern":"could not resolve ssl client authentication, unknown value \\[(.+?)\\], recognised values are \\[(.+?)\\]","errorType":"exception","errorClass":"SslConfigException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslClientAuthenticationMode.java","lineNumber":86,"sourceCode":"     * Configure client authentication of the provided {@link SSLParameters}\n     */\n    public abstract void configure(SSLParameters sslParameters);\n\n    private static final Map<String, SslClientAuthenticationMode> LOOKUP = Collections.unmodifiableMap(buildLookup());\n\n    static Map<String, SslClientAuthenticationMode> buildLookup() {\n        final Map<String, SslClientAuthenticationMode> map = new LinkedHashMap<>(3);\n        map.put(\"none\", NONE);\n        map.put(\"optional\", OPTIONAL);\n        map.put(\"required\", REQUIRED);\n        return map;\n    }\n\n    public static SslClientAuthenticationMode parse(String value) {\n        final SslClientAuthenticationMode mode = LOOKUP.get(value.toLowerCase(Locale.ROOT));\n        if (mode == null) {\n            final String allowedValues = String.join(\",\", LOOKUP.keySet());\n            throw new SslConfigException(\n                \"could not resolve ssl client authentication, unknown value [\" + value + \"], recognised values are [\" + allowedValues + \"]\"\n            );\n        }\n        return mode;\n    }\n}\n","sourceCodeStart":68,"sourceCodeEnd":93,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslClientAuthenticationMode.java#L68-L93","documentation":"SslClientAuthenticationMode.parse lowercases the input and looks it up in a fixed {none, optional, required} map. Any value not exactly matching one of those keys throws SslConfigException with the allowed list. This controls whether the server demands a client cert on inbound TLS.","triggerScenarios":"Calling SslClientAuthenticationMode.parse with a value other than none/optional/required (case-insensitive). Typical offenders: \"require\", \"true\", \"false\", \"yes\", \"on\", \"mandatory\", or a value with leading/trailing whitespace that the caller did not trim.","commonSituations":"Operator writes xpack.security.http.ssl.client_authentication: require (should be required); copies a value from another product's vocabulary; YAML boolean coercion turns the value into true/false.","solutions":["Set the value to one of: none, optional, required (case-insensitive, no quotes needed for YAML).","If using a dynamic config source, trim and validate before passing to parse().","Search the cluster settings for the affected prefix (http.ssl., transport.ssl.) and correct the typo."],"exampleFix":"// before\nxpack.security.http.ssl.client_authentication: require\n// after\nxpack.security.http.ssl.client_authentication: required","handlingStrategy":"validation","validationCode":"private static final Set<String> CLIENT_AUTH_VALUES = Set.of(\"none\",\"optional\",\"required\");\nString normaliseClientAuth(String raw) {\n    if (raw == null) return null;\n    String v = raw.trim().toLowerCase(Locale.ROOT);\n    if (!CLIENT_AUTH_VALUES.contains(v))\n        throw new IllegalArgumentException(\"ssl client_authentication must be one of \" + CLIENT_AUTH_VALUES);\n    return v;\n}","typeGuard":null,"tryCatchPattern":"try {\n    SslClientAuthenticationMode mode = SslClientAuthenticationMode.parse(raw);\n} catch (SslConfigException e) {\n    // surface the allowed list to the operator and fail fast at config load\n    throw new IllegalArgumentException(e.getMessage(), e);\n}","preventionTips":["Constrain the value at the config-source layer (enum in your templating tool).","Add a config lint step that rejects ssl.*.client_authentication values outside the allowed set.","Treat YAML boolean coercion as a smell — quote string settings when in doubt."],"tags":["ssl","config","validation","client-auth"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}