{"record":{"id":"fefe4760dfc52e35","repo":"thanos-io/thanos","slug":"invalid-tls-version-s-valid-values-are-s","errorCode":null,"errorMessage":"invalid TLS version: %s, valid values are %s","messagePattern":"invalid TLS version: (.+?), valid values are (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/tls/options.go","lineNumber":317,"sourceCode":"\t\t}\n\t\tids = append(ids, id)\n\t}\n\treturn ids, nil\n}\n\nfunc GetTlsVersion(tlsMinVersion string) (uint16, error) {\n\n\tvalidOption := validOption{\n\t\ttlsOption: map[string]uint16{\n\t\t\t\"1.0\": tls.VersionTLS10,\n\t\t\t\"1.1\": tls.VersionTLS11,\n\t\t\t\"1.2\": tls.VersionTLS12,\n\t\t\t\"1.3\": tls.VersionTLS13,\n\t\t},\n\t}\n\n\tif _, ok := validOption.tlsOption[tlsMinVersion]; !ok {\n\t\treturn 0, errors.New(fmt.Sprintf(\"invalid TLS version: %s, valid values are %s\", tlsMinVersion, validOption.joinString()))\n\t}\n\n\treturn validOption.tlsOption[tlsMinVersion], nil\n}\n","sourceCodeStart":299,"sourceCodeEnd":322,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/pkg/tls/options.go#L299-L322","documentation":"GetTlsVersion converts a human-readable minimum TLS version string (\"1.0\"..\"1.3\") into Go's uint16 tls.Version* constants. Any other string returns this error listing the valid values. It validates the min TLS version option for both server and client configs.","triggerScenarios":"NewServerConfig or NewClientConfig (via StoreClientTLSCredentials) is passed minTLSVersion values like \"TLS12\", \"tls1.2\", \"1\", \"12\", or empty string.","commonSituations":"Env var TLS_MIN_VERSION set to \"TLSv1.2\" style naming from other tools; empty/unset variable not defaulted; config copied from a library that uses \"VersionTLS12\" identifiers; shell quoting dropping part of the value.","solutions":["Set the value to exactly one of: 1.0, 1.1, 1.2, 1.3.","Fix the env var/flag, e.g. TLS_MIN_VERSION=1.2.","Add a default (\"1.2\") when the variable is empty before calling.","Normalize other naming schemes before passing (strip \"TLS\", \"v\")."],"exampleFix":"# before\nexport TLS_MIN_VERSION=TLSv1.2\n# after\nexport TLS_MIN_VERSION=1.2","handlingStrategy":"validation","validationCode":"var validTLSVersions = map[string]bool{\"1.0\": true, \"1.1\": true, \"1.2\": true, \"1.3\": true}\nfunc checkTLSVersion(v string) error {\n    if !validTLSVersions[v] {\n        return fmt.Errorf(\"TLS version must be one of 1.0, 1.1, 1.2, 1.3, got %q\", v)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"_, err := tls.GetTlsVersion(minTLSVersion)\nif err != nil {\n    return fmt.Errorf(\"%s_min_version invalid, use 1.2 or 1.3: %w\", prefix, err)\n}","preventionTips":["Default to \"1.2\" when the env var is unset.","Accept only the plain forms 1.0/1.1/1.2/1.3.","Normalize inputs like \"TLSv1.2\" to \"1.2\" upstream.","Add the version field to config validation at startup."],"tags":["tls","config","validation","version"],"backgroundTag":"invalid-enum-value","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}