{"id":"2ce05d557a82f402","repo":"gofiber/fiber","slug":"unsupported-tls-version-please-use-tls-versiontls","errorCode":null,"errorMessage":"unsupported TLS version, please use tls.VersionTLS12 or tls.VersionTLS13","messagePattern":"unsupported TLS version, please use tls\\.VersionTLS12 or tls\\.VersionTLS13","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"listen.go","lineNumber":187,"sourceCode":"\t\t\tShutdownTimeout:    10 * time.Second,\n\t\t}\n\t}\n\n\tcfg := config[0]\n\tif cfg.ListenerNetwork == \"\" {\n\t\tcfg.ListenerNetwork = NetworkTCP4\n\t}\n\n\tif cfg.UnixSocketFileMode == 0 {\n\t\tcfg.UnixSocketFileMode = 0o770\n\t}\n\n\tif cfg.TLSMinVersion == 0 {\n\t\tcfg.TLSMinVersion = tls.VersionTLS12\n\t}\n\n\tif cfg.TLSMinVersion != tls.VersionTLS12 && cfg.TLSMinVersion != tls.VersionTLS13 {\n\t\tpanic(\"unsupported TLS version, please use tls.VersionTLS12 or tls.VersionTLS13\")\n\t}\n\n\treturn cfg\n}\n\n// Listen serves HTTP requests from the given addr.\n// You should enter custom ListenConfig to customize startup. (TLS, mTLS, prefork...)\n//\n//\tapp.Listen(\":8080\")\n//\tapp.Listen(\"127.0.0.1:8080\")\n//\tapp.Listen(\":8080\", ListenConfig{EnablePrefork: true})\nfunc (app *App) Listen(addr string, config ...ListenConfig) error {\n\tcfg := listenConfigDefault(config...)\n\n\t// Configure TLS\n\tvar tlsConfig *tls.Config\n\tvar tlsHandler *TLSHandler\n\tif cfg.TLSConfig != nil {","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/listen.go#L169-L205","documentation":"Fiber restricts ListenConfig.TLSMinVersion to TLS 1.2 or TLS 1.3 for security; TLS 1.0 and 1.1 are deprecated (RFC 8996) and vulnerable to known attacks. listenConfigDefault() defaults to TLS 1.2 and panics if you explicitly set any other version, including the deprecated 1.0/1.1.","triggerScenarios":"Calling app.Listen(addr, ListenConfig{TLSMinVersion: tls.VersionTLS10}) or tls.VersionTLS11, or any value other than tls.VersionTLS12/tls.VersionTLS13. Also occurs if a raw uint16 like 0x0301 is passed.","commonSituations":"Integrating with a legacy client that only supports old TLS and attempting to lower the minimum. Copying TLS config from an older codebase that permitted 1.0/1.1. Misunderstanding tls constant values.","solutions":["Use tls.VersionTLS12 or tls.VersionTLS13 for TLSMinVersion, or omit it (defaults to 1.2).","If a legacy peer truly requires old TLS, terminate TLS in a sidecar/proxy that supports it rather than weakening Fiber.","Upgrade the client to support TLS 1.2+."],"exampleFix":"// before\napp.Listen(\":443\", ListenConfig{TLSMinVersion: tls.VersionTLS11})\n// after\napp.Listen(\":443\", ListenConfig{TLSMinVersion: tls.VersionTLS13})","handlingStrategy":"validation","validationCode":"if cfg.TLSMinVersion != 0 &&\n    cfg.TLSMinVersion != tls.VersionTLS12 &&\n    cfg.TLSMinVersion != tls.VersionTLS13 {\n    log.Fatalf(\"unsupported TLSMinVersion %d; use TLS 1.2 or 1.3\", cfg.TLSMinVersion)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Omit TLSMinVersion to accept the secure default (TLS 1.2), or set it explicitly to tls.VersionTLS13.","Never lower to TLS 1.0/1.1 for legacy clients; terminate TLS in a dedicated proxy instead."],"tags":["tls","listen","security","config","panic"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}