fluent/fluentd · error · Fluent::ConfigError

When you set min_version, must set max_version together

Error message

When you set min_version, must set max_version together

What it means

Fluent::ConfigError raised by Fluent::TLS.set_version_to_context (lib/fluent/tls.rb:65) when min_version is supplied without max_version while building an SSLContext. With OpenSSL min/max API support the two bounds must be configured as a pair; a lone min_version leaves the protocol ceiling implicit, which fluentd rejects at config time.

Source

Thrown at lib/fluent/tls.rb:65

                    }.freeze
                    MIN_MAX_AVAILABLE = false
                    map
                  end
    private_constant :METHODS_MAP

    # Helper for old syntax/method support:
    # ruby 2.4 uses ssl_version= but this method is now deprecated.
    # min_version=/max_version= use 'TLS1_2' but ssl_version= uses 'TLSv1_2'
    def set_version_to_context(ctx, version, min_version, max_version)
      if MIN_MAX_AVAILABLE
        case
        when min_version.nil? && max_version.nil?
          min_version = METHODS_MAP[version] || version
          max_version = METHODS_MAP[version] || version
        when min_version.nil? && max_version
          raise Fluent::ConfigError, "When you set max_version, must set min_version together"
        when min_version && max_version.nil?
          raise Fluent::ConfigError, "When you set min_version, must set max_version together"
        else
          min_version = METHODS_MAP[min_version] || min_version
          max_version = METHODS_MAP[max_version] || max_version
        end
        ctx.min_version = min_version
        ctx.max_version = max_version
      else
        ctx.ssl_version = METHODS_MAP[version] || version
      end

      ctx
    end
    module_function :set_version_to_context

    def set_version_to_options(opt, version, min_version, max_version)
      if MIN_MAX_AVAILABLE
        case
        when min_version.nil? && max_version.nil?

View on GitHub (pinned to dd45c6e18d)

Solutions

1. Add the matching max_version, e.g. min_version TLS1_2 + max_version TLS1_3
2. Or use the single-value syntax version TLSv1_2 / ssl_version when only one exact protocol is wanted
3. Run fluentd --dry-run to catch the pair rule before restart

Example fix

# before
<transport tls>
  min_version TLS1_2
</transport>

# after
<transport tls>
  min_version TLS1_2
  max_version TLS1_3
</transport>

min_version = :TLS1_2
max_version = nil
raise 'max_version required with min_version' if min_version && max_version.nil?
# or use single-protocol syntax: version :'TLSv1_2'

When it happens

Trigger: A TLS transport/output section with min_version TLS1_2 and no max_version (and no legacy version/ssl_version fallback); the case branch min_version && max_version.nil? fires during plugin configuration, failing startup or dry-run.

Common situations: Operators adding only min_version TLS1_2 to disable old TLS and assuming the max is open-ended; partial copy from a hardening guide; converting old ssl_version TLSv1_2 config into min_version only.

Related errors

• When you set max_version, must set min_version together
• Cannot enable FIPS compliant mode. OpenSSL FIPS configuratio
• private_key_path is required when cert_path is specified
• ca_private_key_path is required when ca_cert_path is specifi
• no valid cert options configured. specify either 'cert_path'

AI-assisted analysis of fluent/fluentd@dd45c6e18d (2026-08-21). Data as JSON: /api/errors/fb0c78d76eaf3015. Report an issue: GitHub.