elastic/elasticsearch · error · SslConfigException

no supported SSL/TLS protocol was found in the configured su

Error message

no supported SSL/TLS protocol was found in the configured supported protocols: {}

What it means

contextProtocol iterates ORDERED_PROTOCOL_ALGORITHM_MAP (a fixed TLS-version to JCA-algorithm map) and returns the first configured protocol that appears in it. If none of the user's supportedProtocols match a known entry, no algorithm can be selected for SSLContext.getInstance.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfiguration.java:156

        } catch (GeneralSecurityException e) {
            throw new SslConfigException("cannot create ssl context", e);
        }
    }

    /**
     * Picks the best (highest security / most recent standard) SSL/TLS protocol (/version) that is supported by the
     * {@link #supportedProtocols() configured protocols}.
     */
    private String contextProtocol() {
        if (supportedProtocols.isEmpty()) {
            throw new SslConfigException("no SSL/TLS protocols have been configured");
        }
        for (Entry<String, String> entry : ORDERED_PROTOCOL_ALGORITHM_MAP.entrySet()) {
            if (supportedProtocols.contains(entry.getKey())) {
                return entry.getValue();
            }
        }
        throw new SslConfigException(
            "no supported SSL/TLS protocol was found in the configured supported protocols: " + supportedProtocols
        );
    }
}

View on GitHub (pinned to db6a809a66)

Solutions

Include at least one of TLSv1.2 or TLSv1.3 in ssl.supported_protocols (the values that map to a JCA algorithm).
Remove deprecated protocols (SSLv3, TLSv1, TLSv1.1) from the list — they are not in the algorithm map.
Check spelling and case: use the exact IETF token, e.g. "TLSv1.3" not "tlsv1.3" or "TLS 1.3".

Example fix

// before
xpack.security.http.ssl.supported_protocols: [ "SSLv3", "TLSv1" ]
// after
xpack.security.http.ssl.supported_protocols: [ "TLSv1.2", "TLSv1.3" ]

Defensive patterns

Strategy: validation

Validate before calling

private static final Set<String> KNOWN_TLS = Set.of("TLSv1.2","TLSv1.3");
void verifyProtocols(List<String> configured) {
    if (configured.stream().noneMatch(KNOWN_TLS::contains))
        throw new IllegalArgumentException(
            "ssl.supported_protocols must include at least one of " + KNOWN_TLS +
            "; got " + configured);
}

Prevention

Standardise on TLSv1.2/TLSv1.3 across all ssl.* prefixes.
Lint supported_protocols in CI to reject deprecated protocol names.
Use exact IETF tokens (case-sensitive): 'TLSv1.3', not 'tlsv1.3' or 'TLS 1.3'.

When it happens

Trigger: Configuring ssl.supported_protocols with values outside ORDERED_PROTOCOL_ALGORITHM_MAP — e.g. "SSLv2Hello", "SSLv3", "TLSv1.1" when the map only recognises TLSv1.2/TLSv1.3, or typo'd names like "TLS1.2" or "tlsv1.2".

Common situations: Lock-down config that whitelists only an old/deprecated protocol; copy-paste from a nginx/HAProxy config using a different naming convention; case sensitivity.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/3eaa33829a43cd23. Report an issue: GitHub.