denoland/deno · error · NodeTypeError

ERR_TLS_INVALID_PROTOCOL_METHOD

ERR_TLS_INVALID_PROTOCOL_METHOD

Error message

SSLv2 methods disabled

What it means

Inside getProtocolRange, when secureProtocol names no entry in kProtocolMap the disabled families are checked first: SSLv2_method, SSLv2_client_method, and SSLv2_server_method all throw ERR_TLS_INVALID_PROTOCOL_METHOD('SSLv2 methods disabled'). SSLv2 has fundamental protocol flaws and is compiled out of modern TLS backends, so selecting it explicitly is always an error.

Source

Thrown at ext/node/polyfills/_tls_common.ts:310

  if (options.secureProtocol) {
    // If secureProtocol is set, minVersion/maxVersion must not also be set.
    // Node raises this conflict before validating the protocol method string.
    if (options.minVersion || options.maxVersion) {
      throw new ERR_TLS_PROTOCOL_VERSION_CONFLICT(
        options.minVersion || options.maxVersion,
        "secureProtocol",
      );
    }

    const range = kProtocolMap[options.secureProtocol];
    if (!range) {
      if (
        options.secureProtocol === "SSLv2_method" ||
        options.secureProtocol === "SSLv2_client_method" ||
        options.secureProtocol === "SSLv2_server_method"
      ) {
        throw new ERR_TLS_INVALID_PROTOCOL_METHOD("SSLv2 methods disabled");
      }
      if (
        options.secureProtocol === "SSLv3_method" ||
        options.secureProtocol === "SSLv3_client_method" ||
        options.secureProtocol === "SSLv3_server_method"
      ) {
        throw new ERR_TLS_INVALID_PROTOCOL_METHOD("SSLv3 methods disabled");
      }
      throw new ERR_TLS_INVALID_PROTOCOL_METHOD(
        `Unknown method: ${options.secureProtocol}`,
      );
    }

    minVersion = range[0];
    maxVersion = range[1];
  } else {
    if (options.minVersion) {
      if (!SetPrototypeHas(kValidVersions, options.minVersion)) {

View on GitHub (pinned to 89f33cbef2)

Solutions

1. Switch to minVersion: 'TLSv1.2' (or 'TLSv1.3')
2. Or use a supported method string such as 'TLSv1_2_method'
3. Grep configs and docs for SSLv2 method names and remove them
4. If a peer truly only speaks SSLv2, isolate or replace it - it cannot be reached securely

Example fix

// before
const socket = tls.connect({ host, secureProtocol: 'SSLv2_method' });

// after
const socket = tls.connect({ host, minVersion: 'TLSv1.2' });

const DISABLED_METHODS = [
  'SSLv2_method', 'SSLv2_client_method', 'SSLv2_server_method',
  'SSLv3_method', 'SSLv3_client_method', 'SSLv3_server_method',
];
if (DISABLED_METHODS.includes(opts.secureProtocol)) {
  delete opts.secureProtocol;
  opts.minVersion ??= 'TLSv1.2';
}

try {
  tls.connect(opts);
} catch (e) {
  if (e.code === 'ERR_TLS_INVALID_PROTOCOL_METHOD' && /SSLv2/.test(e.message)) {
    const { secureProtocol, ...rest } = opts;
    tls.connect({ ...rest, minVersion: 'TLSv1.2' });
  } else throw e;
}

When it happens

Trigger: tls.connect({ host, secureProtocol: 'SSLv2_method' }); https.createServer({ secureProtocol: 'SSLv2_server_method' }); any legacy config or tutorial value that pins SSLv2.

Common situations: Decade-old connection code kept alive in a corner of the codebase; legacy device integrations that once required SSLv2; config files migrated verbatim between projects.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• ERR_TLS_PROTOCOL_VERSION_CONFLICT
• Unsupported 'alpnProtocols' option provided. 'h2' and 'http/
• ERR_INVALID_CHAR
• ERR_INVALID_CHAR
• ERR_TLS_INVALID_PROTOCOL_VERSION

AI-assisted analysis of denoland/deno@89f33cbef2 (2026-08-16). Data as JSON: /api/errors/71bf51569a63ca8a. Report an issue: GitHub.