unsupported TLS version, please use tls.VersionTLS12 or tls.

Error message

unsupported TLS version, please use tls.VersionTLS12 or tls.VersionTLS13

What it means

Fiber restricts ListenConfig.TLSMinVersion to TLS 1.2 or TLS 1.3 for security; TLS 1.0 and 1.1 are deprecated (RFC 8996) and vulnerable to known attacks. listenConfigDefault() defaults to TLS 1.2 and panics if you explicitly set any other version, including the deprecated 1.0/1.1.

Source

Thrown at listen.go:187

			ShutdownTimeout:    10 * time.Second,
		}
	}

	cfg := config[0]
	if cfg.ListenerNetwork == "" {
		cfg.ListenerNetwork = NetworkTCP4
	}

	if cfg.UnixSocketFileMode == 0 {
		cfg.UnixSocketFileMode = 0o770
	}

	if cfg.TLSMinVersion == 0 {
		cfg.TLSMinVersion = tls.VersionTLS12
	}

	if cfg.TLSMinVersion != tls.VersionTLS12 && cfg.TLSMinVersion != tls.VersionTLS13 {
		panic("unsupported TLS version, please use tls.VersionTLS12 or tls.VersionTLS13")
	}

	return cfg
}

// Listen serves HTTP requests from the given addr.
// You should enter custom ListenConfig to customize startup. (TLS, mTLS, prefork...)
//
//	app.Listen(":8080")
//	app.Listen("127.0.0.1:8080")
//	app.Listen(":8080", ListenConfig{EnablePrefork: true})
func (app *App) Listen(addr string, config ...ListenConfig) error {
	cfg := listenConfigDefault(config...)

	// Configure TLS
	var tlsConfig *tls.Config
	var tlsHandler *TLSHandler
	if cfg.TLSConfig != nil {

View on GitHub (pinned to 9a4c7e57fe)

Solutions

Use tls.VersionTLS12 or tls.VersionTLS13 for TLSMinVersion, or omit it (defaults to 1.2).
If a legacy peer truly requires old TLS, terminate TLS in a sidecar/proxy that supports it rather than weakening Fiber.
Upgrade the client to support TLS 1.2+.

Example fix

// before
app.Listen(":443", ListenConfig{TLSMinVersion: tls.VersionTLS11})
// after
app.Listen(":443", ListenConfig{TLSMinVersion: tls.VersionTLS13})

Defensive patterns

Strategy: validation

Validate before calling

if cfg.TLSMinVersion != 0 &&
    cfg.TLSMinVersion != tls.VersionTLS12 &&
    cfg.TLSMinVersion != tls.VersionTLS13 {
    log.Fatalf("unsupported TLSMinVersion %d; use TLS 1.2 or 1.3", cfg.TLSMinVersion)
}

Prevention

Omit TLSMinVersion to accept the secure default (TLS 1.2), or set it explicitly to tls.VersionTLS13.
Never lower to TLS 1.0/1.1 for legacy clients; terminate TLS in a dedicated proxy instead.

When it happens

Trigger: Calling app.Listen(addr, ListenConfig{TLSMinVersion: tls.VersionTLS10}) or tls.VersionTLS11, or any value other than tls.VersionTLS12/tls.VersionTLS13. Also occurs if a raw uint16 like 0x0301 is passed.

Common situations: Integrating with a legacy client that only supports old TLS and attempting to lower the minimum. Copying TLS config from an older codebase that permitted 1.0/1.1. Misunderstanding tls constant values.

Related errors

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/2ce05d557a82f402.json. Report an issue: GitHub.