{"record":{"id":"fb0c78d76eaf3015","repo":"fluent/fluentd","slug":"when-you-set-min-version-must-set-max-version-tog","errorCode":null,"errorMessage":"When you set min_version, must set max_version together","messagePattern":"When you set min_version, must set max_version together","errorType":"exception","errorClass":"Fluent::ConfigError","httpStatus":null,"severity":"error","filePath":"lib/fluent/tls.rb","lineNumber":65,"sourceCode":"                    }.freeze\n                    MIN_MAX_AVAILABLE = false\n                    map\n                  end\n    private_constant :METHODS_MAP\n\n    # Helper for old syntax/method support:\n    # ruby 2.4 uses ssl_version= but this method is now deprecated.\n    # min_version=/max_version= use 'TLS1_2' but ssl_version= uses 'TLSv1_2'\n    def set_version_to_context(ctx, version, min_version, max_version)\n      if MIN_MAX_AVAILABLE\n        case\n        when min_version.nil? && max_version.nil?\n          min_version = METHODS_MAP[version] || version\n          max_version = METHODS_MAP[version] || version\n        when min_version.nil? && max_version\n          raise Fluent::ConfigError, \"When you set max_version, must set min_version together\"\n        when min_version && max_version.nil?\n          raise Fluent::ConfigError, \"When you set min_version, must set max_version together\"\n        else\n          min_version = METHODS_MAP[min_version] || min_version\n          max_version = METHODS_MAP[max_version] || max_version\n        end\n        ctx.min_version = min_version\n        ctx.max_version = max_version\n      else\n        ctx.ssl_version = METHODS_MAP[version] || version\n      end\n\n      ctx\n    end\n    module_function :set_version_to_context\n\n    def set_version_to_options(opt, version, min_version, max_version)\n      if MIN_MAX_AVAILABLE\n        case\n        when min_version.nil? && max_version.nil?","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/fluent/fluentd/blob/dd45c6e18dc7be33b5e5a0f0767bf46307ff5626/lib/fluent/tls.rb#L47-L83","documentation":"Fluent::ConfigError raised by Fluent::TLS.set_version_to_context (lib/fluent/tls.rb:65) when min_version is supplied without max_version while building an SSLContext. With OpenSSL min/max API support the two bounds must be configured as a pair; a lone min_version leaves the protocol ceiling implicit, which fluentd rejects at config time.","triggerScenarios":"A TLS transport/output section with min_version TLS1_2 and no max_version (and no legacy version/ssl_version fallback); the case branch min_version && max_version.nil? fires during plugin configuration, failing startup or dry-run.","commonSituations":"Operators adding only min_version TLS1_2 to disable old TLS and assuming the max is open-ended; partial copy from a hardening guide; converting old ssl_version TLSv1_2 config into min_version only.","solutions":["Add the matching max_version, e.g. min_version TLS1_2 + max_version TLS1_3","Or use the single-value syntax version TLSv1_2 / ssl_version when only one exact protocol is wanted","Run fluentd --dry-run to catch the pair rule before restart"],"exampleFix":"# before\n<transport tls>\n  min_version TLS1_2\n</transport>\n\n# after\n<transport tls>\n  min_version TLS1_2\n  max_version TLS1_3\n</transport>","handlingStrategy":"validation","validationCode":"min_version = :TLS1_2\nmax_version = nil\nraise 'max_version required with min_version' if min_version && max_version.nil?\n# or use single-protocol syntax: version :'TLSv1_2'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Write min_version/max_version together in one edit","Use version TLSv1_2 single-value form when pinning exactly one protocol","Dry-run TLS config changes in CI"],"tags":["fluentd","tls","ssl","configuration","startup"],"backgroundTag":"tls-version-misconfiguration","analyzedSha":"dd45c6e18dc7be33b5e5a0f0767bf46307ff5626","analyzedAt":"2026-08-21T16:22:07.332Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}