nats-io/nats-server · error

unsupported TLS version: %s

Error message

unsupported TLS version: %s

What it means

After resolving the TLS version number, parseTLSVersion enforces a floor of tls.VersionTLS12. This error means the configured minimum TLS version is below TLS 1.2 (e.g. TLS 1.0/1.1), which the NATS server refuses for security reasons.

Source

Thrown at server/opts.go:5119

		return 0, fmt.Errorf("unrecognized curve preference %s", curveName)
	}
	return curve, nil
}

func parseTLSVersion(v any) (uint16, error) {
	var tlsVersionNumber uint16
	switch v := v.(type) {
	case string:
		n, err := tlsVersionFromString(v)
		if err != nil {
			return 0, err
		}
		tlsVersionNumber = n
	default:
		return 0, fmt.Errorf("'min_version' wrong type: %v", v)
	}
	if tlsVersionNumber < tls.VersionTLS12 {
		return 0, fmt.Errorf("unsupported TLS version: %s", tls.VersionName(tlsVersionNumber))
	}
	return tlsVersionNumber, nil
}

// Helper function to parse TLS configs.
func parseTLS(v any, isClientCtx bool) (t *TLSConfigOpts, retErr error) {
	var (
		tlsm map[string]any
		tc   = TLSConfigOpts{}
		lt   token
		ics  []*tls.CipherSuite // Insecure ciphers found
	)
	defer convertPanicToError(&lt, &retErr)

	tk, v := unwrapValue(v, &lt)
	tlsm = v.(map[string]any)
	for mk, mv := range tlsm {
		tk, mv := unwrapValue(mv, &lt)

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Change min_version to "1.2" or "1.3"
2. Upgrade legacy clients to support TLS 1.2+
3. Remove the min_version override to use defaults

Example fix

// before
min_version: "1.1"
// after
min_version: "1.2"

if cfg.MinVersion != "" && cfg.MinVersion != "1.2" && cfg.MinVersion != "1.3" {
  return fmt.Errorf("min_version %q unsupported; use 1.2 or 1.3", cfg.MinVersion)
}

if err := checkTLSFloor(cfg.TLS.MinVersion); err != nil { log.Fatalf("%v", err) }

When it happens

Trigger: Configuring min_version to "1.0" or "1.1" (or the corresponding numeric constants) in a TLS options block.

Common situations: Migrating old configs that supported legacy clients; security scanners aside, NATS requires >=1.2; environment where compliance policy still asked for TLS 1.0.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• leafnode: %v
• unrecognized cipher %s
• unrecognized curve preference %s
• 'min_version' wrong type: %v
• missing 'key_file' in TLS configuration

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/67ffeedc9589736d. Report an issue: GitHub.