{"record":{"id":"fe32104d69d6fb61","repo":"nsqio/nsq","slug":"unknown-tlsversionoption-q","errorCode":null,"errorMessage":"unknown tlsVersionOption %q","messagePattern":"unknown tlsVersionOption %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"apps/nsqd/options.go","lineNumber":63,"sourceCode":"}{\n\t{tls.VersionTLS10, \"tls1.0\"},\n\t{tls.VersionTLS11, \"tls1.1\"},\n\t{tls.VersionTLS12, \"tls1.2\"},\n\t{tls.VersionTLS13, \"tls1.3\"},\n}\n\nfunc (t *tlsMinVersionOption) Set(s string) error {\n\ts = strings.ToLower(s)\n\tif s == \"\" {\n\t\treturn nil\n\t}\n\tfor _, v := range tlsVersionTable {\n\t\tif s == v.str {\n\t\t\t*t = tlsMinVersionOption(v.val)\n\t\t\treturn nil\n\t\t}\n\t}\n\treturn fmt.Errorf(\"unknown tlsVersionOption %q\", s)\n}\n\nfunc (t *tlsMinVersionOption) Get() interface{} { return uint16(*t) }\n\nfunc (t *tlsMinVersionOption) String() string {\n\tfor _, v := range tlsVersionTable {\n\t\tif uint16(*t) == v.val {\n\t\t\treturn v.str\n\t\t}\n\t}\n\treturn strconv.FormatInt(int64(*t), 10)\n}\n\ntype config map[string]interface{}\n\n// Validate settings in the config file, and fatal on errors\nfunc (cfg config) Validate() {\n\t// special validation/translation","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/nsqio/nsq/blob/85cf10c09c6c3c86160d6f0eb156f62d0efc1648/apps/nsqd/options.go#L45-L81","documentation":"tlsMinVersionOption.Set (apps/nsqd/options.go) parses the --tls-min-version flag by lowercasing the value and matching it against tlsVersionTable, whose only accepted strings are 'tls1.0', 'tls1.1', 'tls1.2' and 'tls1.3' (mapping to the crypto/tls version constants; an empty string is allowed and means default). Anything else returns 'unknown tlsVersionOption %q', and because flag parsing fails, nsqd exits before serving.","triggerScenarios":"Passing --tls-min-version=1.2, --tls-min-version=TLSv1.2, --tls-min-version=ssl3.0, or any string other than tls1.0-tls1.3 (case-insensitive). The value is lowercased first, so 'TLS1.2' is fine but version numbers without the 'tls' prefix are not; SSLv3 has no entry and cannot be selected at all.","commonSituations":"Translating config from other software (nginx ssl_protocols TLSv1.2, grpc '1.2' style) into nsqd flags; hardening scripts that set --tls-min-version=1.3 expecting numeric syntax; someone trying to re-enable SSLv3 for a legacy consumer (not supported).","solutions":["Use one of the exact tokens: --tls-min-version=tls1.2 (or tls1.0, tls1.1, tls1.3; any case is accepted).","Remove the flag entirely to accept nsqd's compiled default minimum version.","Check for stray quotes/whitespace in systemd/compose files that make the value 'tls1.2\\n' or '\\'tls1.2\\''.","If you were trying ssl3.0/tls1.0 for legacy clients, know that ssl3.0 is not in the table and modern Go builds cannot offer it."],"exampleFix":"# before\nnsqd --tls-min-version=1.2\n# unknown tlsVersionOption \"1.2\"\n\n# after\nnsqd --tls-min-version=tls1.2","handlingStrategy":"validation","validationCode":"var tlsVersions = map[string]bool{\"tls1.0\": true, \"tls1.1\": true, \"tls1.2\": true, \"tls1.3\": true}\n\nif v := os.Getenv(\"NSQD_TLS_MIN_VERSION\"); v != \"\" && !tlsVersions[strings.ToLower(v)] {\n    log.Fatalf(\"--tls-min-version must be one of tls1.0..tls1.3, got %q\", v)\n}","typeGuard":"func isValidTLSVersion(s string) bool {\n    switch strings.ToLower(s) {\n    case \"tls1.0\", \"tls1.1\", \"tls1.2\", \"tls1.3\":\n        return true\n    }\n    return false\n}","tryCatchPattern":"// config loaders: parse flags into an error, then report valid tokens together\nif err := flags.Parse(os.Args[1:]); err != nil {\n    if strings.Contains(err.Error(), \"unknown tlsVersionOption\") {\n        return fmt.Errorf(\"bad --tls-min-version; allowed: tls1.0, tls1.1, tls1.2, tls1.3\")\n    }\n}","preventionTips":["Template configs with only the four canonical tokens.","Beware numeric forms from other software (nginx/openssl) — nsqd wants 'tls1.x'.","Add a config-lint stage that greps flags for known-good values."],"tags":["tls","flags","configuration","startup","nsqd"],"backgroundTag":null,"analyzedSha":"85cf10c09c6c3c86160d6f0eb156f62d0efc1648","analyzedAt":"2026-08-16T00:53:05.009Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}