golang/go · error

tls: no supported versions satisfy MinVersion and MaxVersion

Error message

tls: no supported versions satisfy MinVersion and MaxVersion

What it means

Thrown by makeClientHello when config.supportedVersions() returns an empty slice, meaning no TLS version in the library's supported set falls within the configured [MinVersion, MaxVersion] range. This happens when MinVersion > MaxVersion, or when the range excludes all versions the library supports (TLS 1.0 through 1.3).

Source

Thrown at src/crypto/tls/handshake_client.go:64

	if len(config.ServerName) == 0 && !config.InsecureSkipVerify {
		return nil, nil, nil, errors.New("tls: either ServerName or InsecureSkipVerify must be specified in the tls.Config")
	}

	nextProtosLength := 0
	for _, proto := range config.NextProtos {
		if l := len(proto); l == 0 || l > 255 {
			return nil, nil, nil, errors.New("tls: invalid NextProtos value")
		} else {
			nextProtosLength += 1 + l
		}
	}
	if nextProtosLength > 0xffff {
		return nil, nil, nil, errors.New("tls: NextProtos values too large")
	}

	supportedVersions := config.supportedVersions(roleClient, c.quic != nil)
	if len(supportedVersions) == 0 {
		return nil, nil, nil, errors.New("tls: no supported versions satisfy MinVersion and MaxVersion")
	}
	// Since supportedVersions is sorted in descending order, the first element
	// is the maximum version and the last element is the minimum version.
	maxVersion := supportedVersions[0]
	minVersion := supportedVersions[len(supportedVersions)-1]

	hello := &clientHelloMsg{
		vers:                         maxVersion,
		compressionMethods:           []uint8{compressionNone},
		random:                       make([]byte, 32),
		extendedMasterSecret:         true,
		ocspStapling:                 true,
		scts:                         true,
		serverName:                   hostnameInSNI(config.ServerName),
		supportedCurves:              config.curvePreferences(maxVersion),
		supportedPoints:              []uint8{pointFormatUncompressed},
		secureRenegotiationSupported: true,
		alpnProtocols:                config.NextProtos,

View on GitHub (pinned to b6b368adc5)

Solutions

1. Ensure MinVersion <= MaxVersion in the tls.Config
2. Verify at least one supported version (VersionTLS10 through VersionTLS13) falls within [MinVersion, MaxVersion]
3. Leave both MinVersion and MaxVersion as 0 (zero value) to use the library defaults if you do not need explicit version constraints
4. If restricting to TLS 1.3 only, set MinVersion=VersionTLS13 and leave MaxVersion=0 (or set it to VersionTLS13)

Example fix

// before — inverted range
config := &tls.Config{
    MinVersion: tls.VersionTLS13,
    MaxVersion: tls.VersionTLS12, // lower than MinVersion → error
}
// after
config := &tls.Config{
    MinVersion: tls.VersionTLS12,
    MaxVersion: tls.VersionTLS13,
}
// or use defaults:
config := &tls.Config{} // MinVersion=0, MaxVersion=0 → library defaults

func validateVersionRange(config *tls.Config) error {
    if config.MinVersion != 0 && config.MaxVersion != 0 && config.MinVersion > config.MaxVersion {
        return fmt.Errorf("MinVersion (0x%04x) > MaxVersion (0x%04x)", config.MinVersion, config.MaxVersion)
    }
    return nil
}

// Pre-validate before dial:
//
//   if err := validateVersionRange(config); err != nil {
//       config.MinVersion = 0
//       config.MaxVersion = 0 // reset to defaults
//   }

When it happens

Trigger: Setting MinVersion higher than MaxVersion (e.g., MinVersion=VersionTLS13, MaxVersion=VersionTLS12). Setting MaxVersion to a value below all supported versions. Setting MinVersion to a value above all supported versions. Using a future or unsupported version constant.

Common situations: Inverting MinVersion and MaxVersion during configuration. Copying a config designed for TLS 1.2-only and upgrading MinVersion without updating MaxVersion. Programmatically computing version bounds with a comparison bug. Setting MaxVersion to VersionTLS12 while MinVersion defaults to VersionTLS13 through ECH config.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• tls: MinVersion must be >= VersionTLS13 if EncryptedClientHe
• tls: MaxVersion must be >= VersionTLS13 if EncryptedClientHe
• tls: either ServerName or InsecureSkipVerify must be specifi
• tls: invalid NextProtos value
• tls: NextProtos values too large

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/0d90d86bcc12d7fc. Report an issue: GitHub.