{"record":{"id":"f217dab1e023d0c8","repo":"eclipse-vertx/vert.x","slug":"only-tlsv1-3-supported","errorCode":null,"errorMessage":"Only TLSv1.3 supported","messagePattern":"Only TLSv1\\.3 supported","errorType":"exception","errorClass":"SSLException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/spi/tls/QuicSslContextFactory.java","lineNumber":106,"sourceCode":"  public SslContext create() throws SSLException {\n    return createContext(forClient, kmf, tmf);\n  }\n\n  @Override\n  public SslContextFactory enabledCipherSuites(Set<String> enabledCipherSuites) {\n    this.enabledCipherSuites = enabledCipherSuites;\n    return this;\n  }\n\n  @Override\n  public SslContextFactory applicationProtocols(List<String> applicationProtocols) {\n    this.applicationProtocols = applicationProtocols;\n    return this;\n  }\n\n  private SslContext createContext(boolean client, KeyManagerFactory kmf, TrustManagerFactory tmf) throws SSLException {\n    if (!enabledProtocols.contains(\"TLSv1.3\")) {\n      throw new SSLException(\"Only TLSv1.3 supported\");\n    }\n    QuicSslContextBuilder builder;\n    if (client) {\n      builder = QuicSslContextBuilder.forClient();\n      if (kmf != null) {\n        builder.keyManager(kmf, null);\n      }\n      builder.endpointIdentificationAlgorithm(endpointIdentificationAlgorithm);\n    } else {\n      builder = QuicSslContextBuilder.forServer(kmf, null);\n      if (clientAuth != null) {\n        builder.clientAuth(clientAuth);\n      }\n    }\n    builder.keylog(keylog);\n/*\n    Collection<String> cipherSuites = enabledCipherSuites;\n    switch (sslProvider) {","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/spi/tls/QuicSslContextFactory.java#L88-L124","documentation":"QuicSslContextFactory.createContext() throws SSLException when the configured enabled protocols do not include TLSv1.3. QUIC in Vert.x is built on Netty's QUIC implementation which mandates TLS 1.3; QUIC connections cannot be established with older TLS versions, so any other protocol set is rejected at context creation time.","triggerScenarios":"Configuring QuicSslContextFactory with a set of enabled protocols that omits \"TLSv1.3\" (e.g. only TLSv1.2, or an empty/custom set) and then calling create(), which invokes createContext().","commonSituations":"Porting HTTP/3 or QUIC client/server options from TLS settings written for TCP endpoints; explicitly restricting protocols to TLSv1.2 for compliance on a QUIC channel; copying shared TLS config between a normal HTTPS server and a QUIC/HTTP3 server.","solutions":["Ensure \"TLSv1.3\" is present in the enabled protocols set passed to the factory (e.g. Set.of(\"TLSv1.3\") or add it to the existing set).","If TLS 1.2 is a hard requirement, use a regular TCP TLS transport (e.g. HttpServerOptions/HttpClientOptions) instead of the QUIC transport.","Remove custom protocol restrictions from the QUIC configuration and let the factory default to TLSv1.3."],"exampleFix":"// before\nfactory.enabledProtocols(Set.of(\"TLSv1.2\"));\nfactory.create(); // SSLException: Only TLSv1.3 supported\n// after\nfactory.enabledProtocols(Set.of(\"TLSv1.3\"));\nfactory.create();","handlingStrategy":"validation","validationCode":"Set<String> protocols = factory /* enabledProtocols */;\nif (!protocols.contains(\"TLSv1.3\")) throw new IllegalArgumentException(\"QUIC requires TLSv1.3\");","typeGuard":"boolean isQuicCompatible(Set<String> enabled) { return enabled != null && enabled.contains(\"TLSv1.3\"); }","tryCatchPattern":"try { return factory.create(); } catch (SSLException e) { if (e.getMessage().contains(\"Only TLSv1.3\")) { /* fix protocol config */ } throw e; }","preventionTips":["Never restrict protocols below TLSv1.3 for QUIC/HTTP3 endpoints","Keep QUIC TLS config separate from legacy TCP TLS config","Validate protocol sets at startup, not lazily"],"tags":["quic","tls","http3","unsupported-protocol"],"backgroundTag":"unsupported-config-value","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}