What causes "cipher suite %s not supported or doesn't exist" in istio/istio?

cipher suite %s not supported or doesn't exist

Error message

cipher suite %s not supported or doesn't exist

What it means

TLSCipherSuites (pilot/pkg/bootstrap/options.go) maps each name from --tlsCipherSuites to a numeric ID using the allCiphers table, whose keys are Go crypto/tls cipher names. A name not present in the table aborts istiod startup with this error.

Source

Thrown at pilot/pkg/bootstrap/options.go:191

		acceptedCiphers[cipher.Name] = cipher.ID
	}
	for _, cipher := range tls.CipherSuites() {
		acceptedCiphers[cipher.Name] = cipher.ID
	}
	return acceptedCiphers
}

// TLSCipherSuites returns a list of cipher suite IDs from the cipher suite names passed.
func TLSCipherSuites(cipherNames []string) ([]uint16, error) {
	if len(cipherNames) == 0 {
		return nil, nil
	}
	ciphersIntSlice := make([]uint16, 0)
	possibleCiphers := allCiphers()
	for _, cipher := range cipherNames {
		intValue, ok := possibleCiphers[cipher]
		if !ok {
			return nil, fmt.Errorf("cipher suite %s not supported or doesn't exist", cipher)
		}
		ciphersIntSlice = append(ciphersIntSlice, intValue)
	}
	return ciphersIntSlice, nil
}

// TLSMinVersion returns the golang TLS version from the version string passed.
func TLSMinVersion(version string) (uint16, error) {
	switch version {
	case TLSMinVersion1_2:
		return tls.VersionTLS12, nil
	case TLSMinVersion1_3:
		return tls.VersionTLS13, nil
	default:
		return tls.VersionTLS12, fmt.Errorf("minimum TLS version: %s is not supported. Only %s and %s are supported", version, TLSMinVersion1_2, TLSMinVersion1_3)
	}
}

View on GitHub (pinned to 8dc789c5cf)

Solutions

Use exact Go crypto/tls constant names, e.g. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
List supported names from tls.CipherSuites()/tls.InsecureCipherSuites() or inspect allCiphers() in pilot/pkg/bootstrap/options.go
Remove the offending suite from --tlsCipherSuites
After upgrading istio/Go, re-validate every suite in the flag

Example fix

# before: OpenSSL-style name -> "cipher suite ECDHE-RSA-AES128-GCM-SHA256 not supported or doesn't exist"
istiod --tlsCipherSuites=ECDHE-RSA-AES128-GCM-SHA256,ECDHE-RSA-AES256-GCM-SHA384

# after: Go crypto/tls names
istiod --tlsCipherSuites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

Defensive patterns

Strategy: validation

Validate before calling

// Validate cipher names against Go's supported set before passing the flag
valid := map[string]bool{}
for _, cs := range tls.CipherSuites() { valid[cs.Name] = true }
for _, n := range cipherNames {
    if !valid[n] { return fmt.Errorf("cipher suite %s not supported or doesn't exist", n) }
}

Prevention

Use exact Go crypto/tls cipher names (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256), not OpenSSL/IETF strings
Re-validate the cipher list after every istio or Go upgrade
Prefer omitting --tlsCipherSuites to accept secure defaults

When it happens

Trigger: Passing an OpenSSL/IETF-style name (ECDHE-RSA-AES128-GCM-SHA256) instead of the Go name (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256); a typo or wrong case in the flag; referencing a cipher removed in newer istio/Go releases (e.g. CBC or 3DES suites).

Common situations: Translating cipher lists from nginx/Envoy docs into istiod flags; copy-pasting from OpenSSL configs; upgrading istio or its Go toolchain and old flagged ciphers no longer exist.

Related errors

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/49ad9451f6dba786. Report an issue: GitHub.