elastic/elasticsearch · error · SslConfigException

cannot configure SSL/TLS without any supported protocols

Error message

cannot configure SSL/TLS without any supported protocols

What it means

Sibling check to the cipher precondition: SslConfiguration requires a non-null, non-empty list of supported protocols. Without protocols the SSLContext cannot be initialised with a usable algorithm.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfiguration.java:84

    public SslConfiguration(
        String settingPrefix,
        boolean explicitlyConfigured,
        SslTrustConfig trustConfig,
        SslKeyConfig keyConfig,
        SslVerificationMode verificationMode,
        SslClientAuthenticationMode clientAuth,
        List<String> ciphers,
        List<String> supportedProtocols,
        long handshakeTimeoutMillis
    ) {
        this.settingPrefix = settingPrefix;
        this.explicitlyConfigured = explicitlyConfigured;
        if (ciphers == null || ciphers.isEmpty()) {
            throw new SslConfigException("cannot configure SSL/TLS without any supported cipher suites");
        }
        if (supportedProtocols == null || supportedProtocols.isEmpty()) {
            throw new SslConfigException("cannot configure SSL/TLS without any supported protocols");
        }
        this.trustConfig = Objects.requireNonNull(trustConfig, "trust config cannot be null");
        this.keyConfig = Objects.requireNonNull(keyConfig, "key config cannot be null");
        this.verificationMode = Objects.requireNonNull(verificationMode, "verification mode cannot be null");
        this.clientAuth = Objects.requireNonNull(clientAuth, "client authentication cannot be null");
        if (handshakeTimeoutMillis < 1L) {
            throw new SslConfigException("handshake timeout must be at least 1ms");
        }
        this.handshakeTimeoutMillis = handshakeTimeoutMillis;
        this.ciphers = Collections.unmodifiableList(ciphers);
        this.supportedProtocols = Collections.unmodifiableList(supportedProtocols);
    }

    public List<String> getCipherSuites() {
        return ciphers;
    }

    /**

View on GitHub (pinned to db6a809a66)

Solutions

1. Pass a non-empty protocols list — typically TLSv1.2 and TLSv1.3 (SslConfigurationLoader.DEFAULT_PROTOCOLS).
2. If loading from settings, remove the empty ssl.supported_protocols override so defaults apply.
3. In custom loaders, always fall back to DEFAULT_PROTOCOLS rather than returning empty.

Example fix

// before
new SslConfiguration(prefix, true, trust, key, mode, auth,
    ciphers, List.of(), 10_000L); // empty protocols
// after
new SslConfiguration(prefix, true, trust, key, mode, auth,
    ciphers, List.of("TLSv1.2","TLSv1.3"), 10_000L);

List<String> ensureProtocols(List<String> protocols) {
    if (protocols == null || protocols.isEmpty())
        return SslConfigurationLoader.DEFAULT_PROTOCOLS;
    return protocols;
}

When it happens

Trigger: Constructing SslConfiguration with supportedProtocols=null or supportedProtocols=[]. Like 822, the loader's own empty-check (error 829) usually fires first when settings are the source.

Common situations: Programmatic construction with an empty protocols list; a custom loader subclass that nulls out DEFAULT_PROTOCOLS; test fixtures that forget to set protocols.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• no protocols configured in [{}]
• could not resolve ssl client authentication, unknown value [
• cannot configure SSL/TLS without any supported cipher suites
• handshake timeout must be at least 1ms
• no supported SSL/TLS protocol was found in the configured su

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/54393be1959207cb. Report an issue: GitHub.