nats-io/nats-server · error

unrecognized cipher %s

Error message

unrecognized cipher %s

What it means

parseCipher in NATS server option parsing looks up the user-provided cipher suite name in cipherMap and returns this error when the name does not exist. It means the cipher string given in TLS cipher options is not one the server recognizes.

Source

Thrown at server/opts.go:5093

	for k := range cipherMap {
		fmt.Printf("    %s\n", k)
	}
	fmt.Printf("\nAvailable curve preferences include:\n")
	for k := range curvePreferenceMap {
		fmt.Printf("    %s\n", k)
	}
	if runtime.GOOS == "windows" {
		fmt.Printf("%s\n", certstore.Usage)
	}
	fmt.Printf("%s", certidp.OCSPPeerUsage)
	fmt.Printf("%s", OCSPResponseCacheUsage)
	os.Exit(0)
}

func parseCipher(cipherName string) (*tls.CipherSuite, error) {
	cipher, exists := cipherMap[cipherName]
	if !exists {
		return nil, fmt.Errorf("unrecognized cipher %s", cipherName)
	}
	return cipher, nil
}

func parseCurvePreferences(curveName string) (tls.CurveID, error) {
	curve, exists := curvePreferenceMap[curveName]
	if !exists {
		return 0, fmt.Errorf("unrecognized curve preference %s", curveName)
	}
	return curve, nil
}

func parseTLSVersion(v any) (uint16, error) {
	var tlsVersionNumber uint16
	switch v := v.(type) {
	case string:
		n, err := tlsVersionFromString(v)
		if err != nil {

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Use the exact Go/TLS cipher suite name as listed in cipherMap (e.g. 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256')
2. Check available names in the cipherMap definition in server/opts.go
3. If migrating from other servers, translate OpenSSL names to Go TLS names

Example fix

// before
cipher_suites: ["ECDHE-RSA-AES128-GCM-SHA256"]
// after
cipher_suites: ["TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"]

ciphers := []string{"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"}
for _, c := range cfg.CipherSuites {
  if !slices.Contains(ciphers, c) { return fmt.Errorf("unknown cipher %s", c) }
}

if err := checkCiphers(cfg.CipherSuites); err != nil { log.Fatalf("cipher config invalid: %v", err) }

When it happens

Trigger: Passing an unknown string to cipher parsing when building TLSConfigOpts, e.g. via config 'cipher_suites: ["TLS_AES_128_GCM_SHA256X"]' or Options.TLSConfig setup calling parseCipher with a misspelled name.

Common situations: Misspelled cipher names; using OpenSSL-style names ('ECDHE-RSA-AES128-GCM-SHA256') instead of Go TLS names ('TLS_ECDHE_RSA_AES128_GCM_SHA256'); referencing ciphers removed in newer Go/TLS versions.

Related errors

• leafnode: %v
• unrecognized curve preference %s
• 'min_version' wrong type: %v
• unsupported TLS version: %s
• missing 'key_file' in TLS configuration

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/f922f51998dc4d9b. Report an issue: GitHub.