fatedier/frp · warning

create tls config error: %v

Error message

create tls config error: %v

What it means

QUICTunnelSession.Init failed to build the TLS config used for the QUIC dial via transport.NewClientTLSConfig("", "", "", raddr.String()). Inspecting that helper: with all file paths empty it only sets ServerName and InsecureSkipVerify, which cannot fail, so in current upstream code this branch is effectively unreachable.

Source

Thrown at client/visitor/xtcp.go:406

type QUICTunnelSession struct {
	session    *quic.Conn
	listenConn *net.UDPConn
	mu         sync.RWMutex

	clientCfg *v1.ClientCommonConfig
}

func NewQUICTunnelSession(clientCfg *v1.ClientCommonConfig) TunnelSession {
	return &QUICTunnelSession{
		clientCfg: clientCfg,
	}
}

func (qs *QUICTunnelSession) Init(listenConn *net.UDPConn, raddr *net.UDPAddr) error {
	tlsConfig, err := transport.NewClientTLSConfig("", "", "", raddr.String())
	if err != nil {
		return fmt.Errorf("create tls config error: %v", err)
	}
	tlsConfig.NextProtos = []string{"frp"}
	quicConn, err := quic.Dial(context.Background(), listenConn, raddr, tlsConfig,
		&quic.Config{
			MaxIdleTimeout:     time.Duration(qs.clientCfg.Transport.QUIC.MaxIdleTimeout) * time.Second,
			MaxIncomingStreams: int64(qs.clientCfg.Transport.QUIC.MaxIncomingStreams),
			KeepAlivePeriod:    time.Duration(qs.clientCfg.Transport.QUIC.KeepalivePeriod) * time.Second,
		})
	if err != nil {
		return fmt.Errorf("dial quic error: %v", err)
	}
	qs.mu.Lock()
	qs.session = quicConn
	qs.listenConn = listenConn
	qs.mu.Unlock()
	return nil
}

View on GitHub (pinned to 6c8a8d0a97)

Solutions

1. If you see this error you are running modified code; diff pkg/transport/tls.go and client/visitor/xtcp.go against upstream.
2. For upstream frp, treat this error as a signal of binary divergence: reinstall matching frpc/frps releases.
3. File an upstream issue; the branch indicates API drift between caller and helper.

if err := qs.Init(conn, raddr); err != nil {
    if strings.Contains(err.Error(), "create tls config") {
        // unreachable in upstream: indicates fork/version drift — verify binary provenance
    }
}

When it happens

Trigger: NewClientTLSConfig errors only when certPath/keyPath/caPath are non-empty and loading/parsing fails; this caller hardcodes empty strings, so the branch is dead code in practice today.

Common situations: Hitting this message would require a future code change passing TLS file paths here, or a fork that adds validation to the empty-path case.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• dial quic error: %v
• listen on quic udp address %s error: %v
• ErrNoTunnelSession
• open tunnel timeout
• dial udp error: %v

AI-assisted analysis of fatedier/frp@6c8a8d0a97 (2026-08-15). Data as JSON: /api/errors/b55f3be8a6f2bb0b. Report an issue: GitHub.