hashicorp/nomad · error

unsupported TLS version %q

Error message

unsupported TLS version %q

What it means

ParseMinVersion maps a TLS version string (e.g. "tls10", "tls11", "tls12", "tls13") to the corresponding constant using supportedTLSVersions. An unknown string yields this error. An empty version defaults to tls12.

Source

Thrown at helper/tlsutil/config.go:459

	switch privKey.(type) {
	case *rsa.PrivateKey:
		return rsaStringRepr, nil
	case *ecdsa.PrivateKey:
		return ecdsaStringRepr, nil
	default:
		return "", fmt.Errorf("Unsupported signature algorithm %T; RSA and ECDSA only are supported.", privKey)
	}
}

// ParseMinVersion parses the specified minimum TLS version for the Nomad agent
func ParseMinVersion(version string) (uint16, error) {
	if version == "" {
		return supportedTLSVersions["tls12"], nil
	}

	vers, ok := supportedTLSVersions[version]
	if !ok {
		return 0, fmt.Errorf("unsupported TLS version %q", version)
	}

	return vers, nil
}

// ShouldReloadRPCConnections compares two TLS Configurations and determines
// whether they differ such that RPC connections should be reloaded
func ShouldReloadRPCConnections(old, new *config.TLSConfig) (bool, error) {
	var certificateInfoEqual bool
	var rpcInfoEqual bool

	// If already configured with TLS, compare with the new TLS configuration
	if new != nil {
		var err error
		certificateInfoEqual, err = new.CertificateInfoIsEqual(old)
		if err != nil {
			return false, err
		}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Use the exact accepted strings: tls10, tls11, tls12, or tls13 (e.g. tls_min_version = "tls12").
2. Remove tls_min_version to get the tls12 default.
3. Check supportedTLSVersions in helper/tlsutil/config.go for the exact keys.

Example fix

// before
tls_min_version = "TLS1.2"
// after
tls_min_version = "tls12"

valid := map[string]bool{"tls10": true, "tls11": true, "tls12": true, "tls13": true}
if v != "" && !valid[strings.ToLower(v)] {
    return fmt.Errorf("tls_min_version %q invalid; use tls10|tls11|tls12|tls13", v)
}

When it happens

Trigger: Calling ParseMinVersion (via NewTLSConfiguration) with a tls_min_version value not in supportedTLSVersions, such as "TLS1.2", "1.3", or "tlsv1.3".

Common situations: Writing the version with wrong casing/format in the agent config; configs written for other products that accept "1.2"-style values; typo like "tls_12".

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to initialize Consul client config: %v
• cannot reload agent with nil configuration
• https_handshake_timeout must be >= 0
• failed to initialize HTTP server TLS configuration: %s
• failed to configure TLS: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/797ba7421102eb82. Report an issue: GitHub.