nats-io/nats-server · error

unknown version: %v

Error message

unknown version: %v

What it means

tlsVersionFromString maps the config strings '1.0'-'1.3' to tls.VersionTLSxx constants; any other value falls through and yields this error with the offending string. It fires while normalizing TLS min/max version settings (e.g. from tls { min_version: ... }), so an unrecognized version name (typo, '1.4', 'TLS12') is the input at fault.

Source

Thrown at server/server.go:3730

		return "1.2"
	case tls.VersionTLS13:
		return "1.3"
	}
	return fmt.Sprintf("Unknown [0x%x]", ver)
}

func tlsVersionFromString(ver string) (uint16, error) {
	switch ver {
	case "1.0":
		return tls.VersionTLS10, nil
	case "1.1":
		return tls.VersionTLS11, nil
	case "1.2":
		return tls.VersionTLS12, nil
	case "1.3":
		return tls.VersionTLS13, nil
	}
	return 0, fmt.Errorf("unknown version: %v", ver)
}

// Remove a client or route from our internal accounting.
func (s *Server) removeClient(c *client) {
	// kind is immutable, so can check without lock
	switch c.kind {
	case CLIENT:
		c.mu.Lock()
		cid := c.cid
		updateProtoInfoCount := false
		if c.kind == CLIENT && c.opts.Protocol >= ClientProtoInfo {
			updateProtoInfoCount = true
		}
		proxyKey := c.proxyKey
		c.mu.Unlock()

		s.mu.Lock()
		delete(s.clients, cid)

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Use one of the accepted strings exactly: "1.0", "1.1", "1.2", or "1.3"
2. Quote the value in YAML (`first_tls_version: "1.2"`) so it isn't parsed as a float
3. Remove first_tls_version to use the library default
4. Upgrade guidance: prefer "1.2" or "1.3" since older versions are deprecated

Example fix

// before
tls {
  first_tls_version: TLSv1.2
}
// after
tls {
  first_tls_version: "1.2"
}

// Validate TLS version strings against the accepted set
var validTLSVersions = map[string]bool{"1.0": true, "1.1": true, "1.2": true, "1.3": true}

func checkTLSVersion(v string) error {
    if v != "" && !validTLSVersions[v] {
        return fmt.Errorf("first_tls_version must be one of 1.0,1.1,1.2,1.3, got %q", v)
    }
    return nil
}

When it happens

Trigger: Config `tls` block (or route/monitor TLS config) sets `first_tls_version` / version string parsed by this helper with a value not in {"1.0","1.1","1.2","1.3"}; the switch falls through and returns the error.

Common situations: Setting `first_tls_version: 1.4` (not a real version); writing "TLSv1.2" or "tls1.2" instead of bare "1.2"; YAML parsing 1.2 as a float 1.2 vs string — formatting issues after copy-paste.

Related errors

• TLS cert and key required for HTTPS
• 'cert_file' and 'cert_store' may not both be configured
• expected 'cert_store' to be a valid non-empty string
• expected 'cert_match_by' to be a valid non-empty string
• expected 'cert_match' to be a valid non-empty string

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/5f56bcadf8985dd9. Report an issue: GitHub.