{"record":{"id":"eaebae585c018edc","repo":"cloudflare/cloudflared","slug":"could-not-create-tls-configuration-w","errorCode":null,"errorMessage":"could not create TLS configuration: %w","messagePattern":"could not create TLS configuration: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"supervisor/tunnel.go","lineNumber":470,"sourceCode":"\t)\n\n\tswitch protocol {\n\tcase connection.QUIC:\n\t\t// nolint: gosec\n\t\tconnOptions := e.config.connectionOptions(addr.UDP.String(), uint8(backoff.Retries()))\n\t\t// nolint: zerologlint\n\t\tconnOptions.LogFields(connLog.Logger().Debug().Uint8(connection.LogFieldConnIndex, connIndex)).Msgf(\"Tunnel connection options\")\n\t\treturn e.serveQUIC(ctx,\n\t\t\taddr.UDP.AddrPort(),\n\t\t\tconnLog,\n\t\t\tconnOptions,\n\t\t\tcontrolStream,\n\t\t\tconnIndex)\n\n\tcase connection.HTTP2:\n\t\ttlsConfig, err := cfdcrypto.TLSConfigWithCurvePreferences(e.config.EdgeTLSConfigs[protocol], e.config.connectionFeatures().PostQuantum)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"could not create TLS configuration: %w\", err), true\n\t\t}\n\n\t\tconnLog.Logger().Info().Msgf(\"Tunnel connection curve preferences: %v\", tlsConfig.CurvePreferences)\n\n\t\tedgeConn, err := edgediscovery.DialEdge(ctx, dialTimeout, tlsConfig, addr.TCP, e.edgeBindAddr)\n\t\tif err != nil {\n\t\t\tconnLog.ConnAwareLogger().Err(err).Msg(\"Unable to establish connection with Cloudflare edge\")\n\t\t\treturn err, true\n\t\t}\n\n\t\t// Rebuild the connection options with the local address now that the\n\t\t// edge socket is established.\n\t\t// nolint: gosec\n\t\tconnOptions := e.config.connectionOptions(edgeConn.LocalAddr().String(), uint8(backoff.Retries()))\n\t\t// nolint: zerologlint\n\t\tconnOptions.LogFields(connLog.Logger().Debug().Uint8(connection.LogFieldConnIndex, connIndex)).Msgf(\"Tunnel connection options\")\n\t\tif err := e.serveHTTP2(\n\t\t\tctx,","sourceCodeStart":452,"sourceCodeEnd":488,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/supervisor/tunnel.go#L452-L488","documentation":"When serving a tunnel over HTTP/2, cloudflared builds a per-connection TLS config by cloning the base EdgeTLSConfigs entry and applying post-quantum curve preferences via cfdcrypto.TLSConfigWithCurvePreferences. If that fails (invalid base config, unsupported curve for the build, nil config), serveConnection returns this wrapped error and marks it recoverable so the supervisor can retry with backoff.","triggerScenarios":"EdgeTLSConfigs lacks a valid *tls.Config for the HTTP2 protocol (e.g. CA/cert loading failed earlier), or TLSConfigWithCurvePreferences rejects the requested post-quantum curve combination for the current build/platform.","commonSituations":"Corrupt or missing origin/edge CA pool configuration; FIPS or post-quantum flag combinations unsupported in the binary; a bug where the base TLS config was never initialized before serveTunnel ran; misconfigured `--edge-ip-version`/protocol forced to HTTP2 on an exotic build.","solutions":["Check earlier startup logs for CA/TLS initialization failures — the base EdgeTLSConfigs[HTTP2] may be nil or incomplete.","If you passed --post-quantum, verify the build supports it (non-FIPS, recent cloudflared); try without the flag.","Upgrade cloudflared to the latest version so curve preferences match edge requirements.","Clear broken local config (cert.pem / CA pool) and re-run `cloudflared tunnel login` to regenerate credentials.","Let protocol selection fall back from HTTP2 to QUIC (do not force --protocol http2) if the failure persists."],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":"func asError(r interface{}) (error, bool) {\n\tif err, ok := r.(error); ok {\n\t\treturn err, true\n\t}\n\treturn nil, false\n}","tryCatchPattern":"defer func() {\n\tif r := recover(); r != nil {\n\t\terr, ok := r.(error)\n\t\tif !ok {\n\t\t\terr = fmt.Errorf(\"ServeTunnel: %v\", r)\n\t\t}\n\t\tlog.Error().Str(\"stack\", string(debug.Stack())).Msg(\"tunnel goroutine panicked\")\n\t\trecoverable = true\n\t}\n}()","preventionTips":["Always panic with error values, never raw strings/ints.","Run the race detector in CI to catch concurrency panics.","Review the wrapped stack trace before assuming an infrastructure problem."],"tags":["tls","http2","post-quantum"],"backgroundTag":"invalid-config-value","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}