fluent/fluentd · error · Fluent::ConfigError

When you set max_version, must set min_version together

Error message

When you set max_version, must set min_version together

What it means

Fluent::ConfigError raised by Fluent::TLS.set_version_to_context (lib/fluent/tls.rb:63) when configuring an SSLContext for TLS transports: max_version was supplied but min_version was not. On Rubies with OpenSSL min_version/max_version support (MIN_MAX_AVAILABLE), fluentd requires the pair to be set together so the enabled protocol range is explicit; a lone max_version would leave the floor ambiguous.

Source

Thrown at lib/fluent/tls.rb:63

                      TLS1_1: :'TLSv1_1',
                      TLS1_2: :'TLSv1_2',
                    }.freeze
                    MIN_MAX_AVAILABLE = false
                    map
                  end
    private_constant :METHODS_MAP

    # Helper for old syntax/method support:
    # ruby 2.4 uses ssl_version= but this method is now deprecated.
    # min_version=/max_version= use 'TLS1_2' but ssl_version= uses 'TLSv1_2'
    def set_version_to_context(ctx, version, min_version, max_version)
      if MIN_MAX_AVAILABLE
        case
        when min_version.nil? && max_version.nil?
          min_version = METHODS_MAP[version] || version
          max_version = METHODS_MAP[version] || version
        when min_version.nil? && max_version
          raise Fluent::ConfigError, "When you set max_version, must set min_version together"
        when min_version && max_version.nil?
          raise Fluent::ConfigError, "When you set min_version, must set max_version together"
        else
          min_version = METHODS_MAP[min_version] || min_version
          max_version = METHODS_MAP[max_version] || max_version
        end
        ctx.min_version = min_version
        ctx.max_version = max_version
      else
        ctx.ssl_version = METHODS_MAP[version] || version
      end

      ctx
    end
    module_function :set_version_to_context

    def set_version_to_options(opt, version, min_version, max_version)
      if MIN_MAX_AVAILABLE

View on GitHub (pinned to dd45c6e18d)

Solutions

1. Add the matching min_version, e.g. min_version TLS1_2 together with max_version TLS1_3
2. Or remove max_version and use the single legacy ssl_version / version option (e.g. version TLSv1_2) when you want exactly one protocol
3. Validate the config with fluentd --dry-run before deploying TLS changes

Example fix

# before
<transport tls>
  cert_path /etc/fluent/cert.pem
  max_version TLS1_3
</transport>

# after
<transport tls>
  cert_path /etc/fluent/cert.pem
  min_version TLS1_2
  max_version TLS1_3
</transport>

min_version = nil
max_version = :TLS1_3
raise 'min_version required with max_version' if max_version && min_version.nil?
# or pre-normalize: min_version ||= :TLS1_2

When it happens

Trigger: A TLS plugin section (in_forward/in_http TLS, out_forward TLS, etc.) setting max_version TLS1_3 without min_version, while ssl_version (the legacy single-value option) is unset. Both nil is fine (version default applies); min_version alone or max_version alone raises.

Common situations: Hardening configs: an operator adds max_version TLS1_3 to cap protocols but forgets the floor; copying a partial example from docs; migrating from deprecated ssl_version to min/max syntax and dropping one line.

Related errors

• When you set min_version, must set max_version together
• Cannot enable FIPS compliant mode. OpenSSL FIPS configuratio
• private_key_path is required when cert_path is specified
• ca_private_key_path is required when ca_cert_path is specifi
• no valid cert options configured. specify either 'cert_path'

AI-assisted analysis of fluent/fluentd@dd45c6e18d (2026-08-21). Data as JSON: /api/errors/2477a493a839a363. Report an issue: GitHub.