{"id":"0e697cb5172f730d","repo":"go-sql-driver/mysql","slug":"tls-requested-but-server-does-not-support-tls","errorCode":null,"errorMessage":"TLS requested but server does not support TLS","messagePattern":"TLS requested but server does not support TLS","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"errors.go","lineNumber":22,"sourceCode":"//\n// This Source Code Form is subject to the terms of the Mozilla Public\n// License, v. 2.0. If a copy of the MPL was not distributed with this file,\n// You can obtain one at http://mozilla.org/MPL/2.0/.\n\npackage mysql\n\nimport (\n\t\"errors\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n)\n\n// Various errors the driver might return. Can change between driver versions.\nvar (\n\tErrInvalidConn       = errors.New(\"invalid connection\")\n\tErrMalformPkt        = errors.New(\"malformed packet\")\n\tErrNoTLS             = errors.New(\"TLS requested but server does not support TLS\")\n\tErrCleartextPassword = errors.New(\"this user requires clear text authentication. If you still want to use it, please add 'allowCleartextPasswords=1' to your DSN\")\n\tErrNativePassword    = errors.New(\"this user requires mysql native password authentication\")\n\tErrOldPassword       = errors.New(\"this user requires old password authentication. If you still want to use it, please add 'allowOldPasswords=1' to your DSN. See also https://github.com/go-sql-driver/mysql/wiki/old_passwords\")\n\tErrUnknownPlugin     = errors.New(\"this authentication plugin is not supported\")\n\tErrOldProtocol       = errors.New(\"MySQL server does not support required protocol 41+\")\n\tErrPktSync           = errors.New(\"commands out of sync. You can't run this command now\")\n\tErrPktSyncMul        = errors.New(\"commands out of sync. Did you run multiple statements at once?\")\n\tErrPktTooLarge       = errors.New(\"packet for query is too large. Try adjusting the `Config.MaxAllowedPacket`\")\n\tErrBusyBuffer        = errors.New(\"busy buffer\")\n\n\t// errBadConnNoWrite is used for connection errors where nothing was sent to the database yet.\n\t// If this happens first in a function starting a database interaction, it should be replaced by driver.ErrBadConn\n\t// to trigger a resend. Use mc.markBadConn(err) to do this.\n\t// See https://github.com/go-sql-driver/mysql/pull/302\n\terrBadConnNoWrite = errors.New(\"bad connection\")\n)\n\nvar defaultLogger = Logger(log.New(os.Stderr, \"[mysql] \", log.Ldate|log.Ltime))","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/go-sql-driver/mysql/blob/c426bd93799de0f0e094c8f0582872c529d0ed0a/errors.go#L4-L40","documentation":"ErrNoTLS is returned during the handshake (packets.go:223) when the client configured TLS (cfg.TLS != nil, e.g. tls=true/skip-verify/custom) but the server's capability flags do not include clientSSL, meaning the server does not support TLS — and the DSN did not set allowFallbackToPlaintext. This prevents silently downgrading an encrypted connection to plaintext.","triggerScenarios":"Connecting with `?tls=true` (or a registered TLS config) to a MySQL server started without SSL support (mysqld compiled/started without TLS, or ssl disabled). packets.go:219-224 checks capabilities & clientSSL == 0 and, unless AllowFallbackToPlaintext is true, returns ErrNoTLS.","commonSituations":"Pointing a TLS-configured client at a dev MySQL that has no certificates; server that supports TLS but the specific listener/account/port does not; misconfigured ProxySQL/intermediary that strips the SSL capability bit.","solutions":["Enable TLS on the MySQL server: provision certs and start mysqld with --ssl, or set require_secure_transport appropriately.","If plaintext is acceptable on this link, add `allowFallbackToPlaintext=true` to the DSN so the driver drops TLS instead of erroring.","Verify you are connecting to the intended host/port and that no intermediary strips the SSL capability."],"exampleFix":"// before\ndsn := \"u:p@tcp(host:3306)/db?tls=true\"\n// after (option A: enable server TLS, keep dsn) \n//   OR option B: explicitly allow plaintext fallback\ndsn := \"u:p@tcp(host:3306)/db?tls=true&allowFallbackToPlaintext=true\"","handlingStrategy":"fallback","validationCode":"tlsOK, _ := strconv.ParseBool(os.Getenv(\"MYSQL_TLS\"))\nif !tlsOK {\n    // do not request TLS\n} else {\n    dsn += \"&allowFallbackToPlaintext=true\"\n}","typeGuard":null,"tryCatchPattern":"err := ping()\nif errors.Is(err, mysql.ErrNoTLS) {\n    if allowPlaintext {\n        dsn += \"&allowFallbackToPlaintext=true\" // retry path\n    }\n}","preventionTips":["Enable TLS on the server before requiring it in clients.","Use allowFallbackToPlaintext only when plaintext is acceptable.","Smoke-test the handshake against the exact server/port."],"tags":["tls","security","connection"],"analyzedSha":"c426bd93799de0f0e094c8f0582872c529d0ed0a","analyzedAt":"2026-08-04T21:52:59.219Z","schemaVersion":2}