{"record":{"id":"f922f51998dc4d9b","repo":"nats-io/nats-server","slug":"unrecognized-cipher-s","errorCode":null,"errorMessage":"unrecognized cipher %s","messagePattern":"unrecognized cipher (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/opts.go","lineNumber":5093,"sourceCode":"\tfor k := range cipherMap {\n\t\tfmt.Printf(\"    %s\\n\", k)\n\t}\n\tfmt.Printf(\"\\nAvailable curve preferences include:\\n\")\n\tfor k := range curvePreferenceMap {\n\t\tfmt.Printf(\"    %s\\n\", k)\n\t}\n\tif runtime.GOOS == \"windows\" {\n\t\tfmt.Printf(\"%s\\n\", certstore.Usage)\n\t}\n\tfmt.Printf(\"%s\", certidp.OCSPPeerUsage)\n\tfmt.Printf(\"%s\", OCSPResponseCacheUsage)\n\tos.Exit(0)\n}\n\nfunc parseCipher(cipherName string) (*tls.CipherSuite, error) {\n\tcipher, exists := cipherMap[cipherName]\n\tif !exists {\n\t\treturn nil, fmt.Errorf(\"unrecognized cipher %s\", cipherName)\n\t}\n\treturn cipher, nil\n}\n\nfunc parseCurvePreferences(curveName string) (tls.CurveID, error) {\n\tcurve, exists := curvePreferenceMap[curveName]\n\tif !exists {\n\t\treturn 0, fmt.Errorf(\"unrecognized curve preference %s\", curveName)\n\t}\n\treturn curve, nil\n}\n\nfunc parseTLSVersion(v any) (uint16, error) {\n\tvar tlsVersionNumber uint16\n\tswitch v := v.(type) {\n\tcase string:\n\t\tn, err := tlsVersionFromString(v)\n\t\tif err != nil {","sourceCodeStart":5075,"sourceCodeEnd":5111,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/opts.go#L5075-L5111","documentation":"parseCipher in NATS server option parsing looks up the user-provided cipher suite name in cipherMap and returns this error when the name does not exist. It means the cipher string given in TLS cipher options is not one the server recognizes.","triggerScenarios":"Passing an unknown string to cipher parsing when building TLSConfigOpts, e.g. via config 'cipher_suites: [\"TLS_AES_128_GCM_SHA256X\"]' or Options.TLSConfig setup calling parseCipher with a misspelled name.","commonSituations":"Misspelled cipher names; using OpenSSL-style names ('ECDHE-RSA-AES128-GCM-SHA256') instead of Go TLS names ('TLS_ECDHE_RSA_AES128_GCM_SHA256'); referencing ciphers removed in newer Go/TLS versions.","solutions":["Use the exact Go/TLS cipher suite name as listed in cipherMap (e.g. 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256')","Check available names in the cipherMap definition in server/opts.go","If migrating from other servers, translate OpenSSL names to Go TLS names"],"exampleFix":"// before\ncipher_suites: [\"ECDHE-RSA-AES128-GCM-SHA256\"]\n// after\ncipher_suites: [\"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\"]","handlingStrategy":"validation","validationCode":"ciphers := []string{\"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\", \"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256\"}\nfor _, c := range cfg.CipherSuites {\n  if !slices.Contains(ciphers, c) { return fmt.Errorf(\"unknown cipher %s\", c) }\n}","typeGuard":null,"tryCatchPattern":"if err := checkCiphers(cfg.CipherSuites); err != nil { log.Fatalf(\"cipher config invalid: %v\", err) }","preventionTips":["Only use Go-standard cipher suite names (TLS_... prefix)","Keep a checked-in allowlist of ciphers","Test config with 'nats-server -t' before deploying"],"tags":["tls","config-validation","cipher"],"backgroundTag":"unrecognized-tls-cipher","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}