thanos-io/thanos · error

invalid cipher suite

Error message

invalid cipher suite: %s, valid values are %s

What it means

getCipherSuiteIDs maps cipher suite names from the TLS config to Go's uint16 IDs. Any name not present in the known cipherMap produces this error listing all accepted names. It is a strict enum-style validation of the cipher-suites option.

Solutions

1. Use exactly one of the names printed in the error message (copy-paste from the valid values list).
2. Remove TLS 1.3 cipher names — Go always enables them and does not accept them in CipherSuites.
3. Update config to names matching this library's cipherMap (see pkg/tls/options.go).
4. Fix typos/case — names are matched exactly.

Example fix

# before
tls_cipher_suites: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_AES_128_GCM_SHA256
# after
tls_cipher_suites: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384  # pick from the valid-values list only

func validCipherNames(names []string, valid map[string]uint16) error {
    for _, n := range names {
        if _, ok := valid[n]; !ok {
            return fmt.Errorf("unknown cipher suite %q", n)
        }
    }
    return nil
}

_, err := tls.NewServerConfig(logger, cipherSuites, curves, ver, ...)
if err != nil && strings.Contains(err.Error(), "invalid cipher suite") {
    return fmt.Errorf("fix tls.cipher_suites config: %w", err)
}

When it happens

Trigger: NewServerConfig is called with a cipher-suites list containing an unrecognized name (typo, OpenSSL-style name like TLS_AES_256_GCM_SHA384 vs Go's naming, TLS 1.3 suite names that Go configures separately, or deprecated suite removed from the map).

Common situations: Config copied from nginx/openssl documentation using different naming conventions; including TLS 1.3 ciphers (in Go they are not settable via CipherSuites); typo such as TLS_RSA_WITH_3DES... removed from Go; older/newer config versions with renamed suites.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• both client key and certificate must be provided
• invalid curve: , valid values are
• invalid TLS version: , valid values are
• unsupported format for label
• --auto-gomemlimit.ratio must be greater than 0 and less…

AI-assisted analysis of thanos-io/thanos@35b8b99117 (2026-09-07). Data as JSON: /api/errors/37b64388bffde1a3. Report an issue: GitHub.

Appendix: source

Thrown at pkg/tls/options.go:266

		return nil, nil
	}

	supported := tls.CipherSuites()
	cipherMap := make(map[string]uint16, len(supported))
	for _, cs := range supported {
		cipherMap[cs.Name] = cs.ID
	}
	validNames := make([]string, 0, len(cipherMap))
	for n := range cipherMap {
		validNames = append(validNames, n)
	}
	sort.Strings(validNames)

	ids := make([]uint16, 0, len(ciphers))
	for _, name := range ciphers {
		id, ok := cipherMap[name]
		if !ok {
			return nil, errors.New(fmt.Sprintf("invalid cipher suite: %s, valid values are %s", name, strings.Join(validNames, ", ")))
		}
		ids = append(ids, id)
	}
	return ids, nil
}

func getCurveIDs(curves []string) ([]tls.CurveID, error) {
	if len(curves) == 0 {
		return nil, nil
	}

	// Manual mapping since crypto/tls doesn't provide enumeration
	curveMap := map[string]tls.CurveID{
		"CurveP256":          tls.CurveP256,
		"CurveP384":          tls.CurveP384,
		"CurveP521":          tls.CurveP521,
		"X25519":             tls.X25519,
		"X25519MLKEM768":     tls.X25519MLKEM768,

View on GitHub (pinned to 35b8b99117)