hashicorp/nomad · error

unsupported TLS cipher %q

Error message

unsupported TLS cipher %q

What it means

ParseCiphers converts a comma-separated TLSCipherSuites string into []uint16 using the supportedTLSCiphers lookup table. Any cipher name not present in the table is rejected with this error. It prevents silently running with ciphers the library doesn't know.

Source

Thrown at helper/tlsutil/config.go:396

// ParseCiphers parses ciphersuites from the comma-separated string into
// recognized slice
func ParseCiphers(tlsConfig *config.TLSConfig) ([]uint16, error) {
	suites := []uint16{}

	cipherStr := strings.TrimSpace(tlsConfig.TLSCipherSuites)

	var parsedCiphers []string
	if cipherStr == "" {
		parsedCiphers = defaultTLSCiphers

	} else {
		parsedCiphers = strings.Split(tlsConfig.TLSCipherSuites, ",")
	}
	for _, cipher := range parsedCiphers {
		c, ok := supportedTLSCiphers[cipher]
		if !ok {
			return suites, fmt.Errorf("unsupported TLS cipher %q", cipher)
		}
		suites = append(suites, c)
	}

	// Ensure that the specified cipher suite list is supported by the TLS
	// Certificate signature algorithm. This is a check for user error, where a
	// TLS certificate could support RSA but a user has configured a cipher suite
	// list of ciphers where only ECDSA is supported.
	keyLoader := tlsConfig.GetKeyLoader()

	// Ensure that the keypair has been loaded before continuing
	keyLoader.LoadKeyPair(tlsConfig.CertFile, tlsConfig.KeyFile)

	if keyLoader.GetCertificate() != nil {
		supportedSignatureAlgorithm, err := getSignatureAlgorithm(keyLoader.GetCertificate())
		if err != nil {
			return []uint16{}, err
		}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Correct the cipher name to one supported by the library (e.g. TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384).
2. Remove the unsupported cipher from tls_cipher_suites and let the default set apply.
3. Check supportedTLSCiphers in helper/tlsutil/config.go for the exact accepted names.

Example fix

// before
tls_cipher_suites = "ECDHE-RSA-AES128-GCM-SHA256"
// after
tls_cipher_suites = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"

supported := map[string]bool{ "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": true, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": true /* ...see supportedTLSCiphers */ }
for _, c := range strings.Split(tlsCipherSuites, ",") {
    if !supported[strings.TrimSpace(c)] {
        return fmt.Errorf("cipher %q not supported", c)
    }
}

When it happens

Trigger: Calling ParseCiphers (via NewTLSConfiguration) with TLSCipherSuites containing a name not in supportedTLSCiphers, e.g. a misspelled name or a cipher not supported by Go's crypto/tls.

Common situations: Copying OpenSSL/OpenSSH cipher names (e.g. 'ECDHE-RSA-AES128-GCM-SHA256') instead of the Go/consul-style names like 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'; enabling TLS 1.3-only ciphers not in the table.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to initialize Consul client config: %v
• cannot reload agent with nil configuration
• https_handshake_timeout must be >= 0
• failed to initialize HTTP server TLS configuration: %s
• failed to configure TLS: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/1d8bed159b9b64cf. Report an issue: GitHub.