tailscale/tailscale · error

control server is too old; no noise key

Error message

control server is too old; no noise key

What it means

Returned by controlclient's key bootstrap when, after fetching /key, the server advertised no ts2021 Noise public key (serverNoiseKey.IsZero()). It means the configured control server predates ts2021 Noise transport and cannot carry out a modern Noise connection.

Source

Thrown at control/controlclient/direct.go:689

			return regen, opt.URL, nil, err
		}
		c.logf("control server key from %s: ts2021=%s, legacy=%v", c.serverURL, keys.PublicKey.ShortString(), keys.LegacyPublicKey.ShortString())

		c.mu.Lock()
		c.serverLegacyKey = keys.LegacyPublicKey
		c.serverNoiseKey = keys.PublicKey
		c.mu.Unlock()
		serverKey = keys.LegacyPublicKey
		serverNoiseKey = keys.PublicKey

		// Proactively shut down our TLS TCP connection.
		// We're not going to need it and it's nicer to the
		// server.
		c.httpc.CloseIdleConnections()
	}

	if serverNoiseKey.IsZero() {
		return false, "", nil, errors.New("control server is too old; no noise key")
	}

	var oldNodeKey key.NodePublic
	switch {
	case opt.Logout:
		tryingNewKey = persist.PrivateNodeKey
	case opt.URL != "":
		// Nothing.
	case regen || persist.PrivateNodeKey.IsZero():
		c.logf("Generating a new nodekey.")
		persist.OldPrivateNodeKey = persist.PrivateNodeKey
		tryingNewKey = key.NewNode()
	default:
		// Try refreshing the current key first
		tryingNewKey = persist.PrivateNodeKey
	}
	if !persist.OldPrivateNodeKey.IsZero() {
		oldNodeKey = persist.OldPrivateNodeKey.Public()

View on GitHub (pinned to 5201273aec)

Solutions

1. Point the client at a control server running a version that supports ts2021 (Noise) keys
2. Force the legacy TLS transport if the deployment intentionally runs an old control server
3. Verify the control URL is not a broken proxy that strips the ts2021 key from the key response

When it happens

Trigger: Thrown at control/controlclient/direct.go:731 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@5201273aec (2026-08-18). Data as JSON: /api/errors/7e9793a5d826c8f1. Report an issue: GitHub.