thanos-io/thanos · error

invalid curve: , valid values are

Error message

invalid curve: %s, valid values are %s

What it means

getCurveIDs maps elliptic-curve names from the TLS config to tls.CurveID values. An unrecognized curve name yields this error with the list of valid names. Strict validation of the curve-preferences option.

Solutions

1. Use only curve names listed in the error message (copy from valid values).
2. Remove unsupported curves such as X448 or secp256k1.
3. Normalize names to the library's expected spelling (e.g. P-256/P-384/P-521/X25519 per curveMap).
4. Align the config with the version of this library in use.

Example fix

# before
tls_elliptic_curves: X25519,X448
# after
tls_elliptic_curves: X25519,P-256

func validCurveNames(names []string, valid map[string]tls.CurveID) error {
    for _, n := range names {
        if _, ok := valid[n]; !ok {
            return fmt.Errorf("unknown curve %q", n)
        }
    }
    return nil
}

_, err := tls.NewServerConfig(logger, cipherSuites, curves, ver, ...)
if err != nil && strings.Contains(err.Error(), "invalid curve") {
    return fmt.Errorf("fix tls elliptic-curves config: %w", err)
}

When it happens

Trigger: NewServerConfig is called with an elliptic-curves list containing a name absent from curveMap (e.g. "X448", "secp256k1", OpenSSL-style names, or typos like "P-521" vs accepted spelling).

Common situations: Config copied from OpenSSL (which supports more curves than Go's TLS stack); including curves Go does not support (X448, secp256k1); inconsistent naming (P-256 vs CurveP256); config written for a different library version.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• both client key and certificate must be provided
• invalid cipher suite
• invalid TLS version: , valid values are
• unsupported format for label
• --auto-gomemlimit.ratio must be greater than 0 and less…

AI-assisted analysis of thanos-io/thanos@35b8b99117 (2026-09-07). Data as JSON: /api/errors/0cd697e25aa8afcd. Report an issue: GitHub.

Appendix: source

Thrown at pkg/tls/options.go:298

		"CurveP256":          tls.CurveP256,
		"CurveP384":          tls.CurveP384,
		"CurveP521":          tls.CurveP521,
		"X25519":             tls.X25519,
		"X25519MLKEM768":     tls.X25519MLKEM768,
		"SecP256r1MLKEM768":  tls.SecP256r1MLKEM768,
		"SecP384r1MLKEM1024": tls.SecP384r1MLKEM1024,
	}
	validNames := make([]string, 0, len(curveMap))
	for n := range curveMap {
		validNames = append(validNames, n)
	}
	sort.Strings(validNames)

	ids := make([]tls.CurveID, 0, len(curves))
	for _, name := range curves {
		id, ok := curveMap[name]
		if !ok {
			return nil, errors.New(fmt.Sprintf("invalid curve: %s, valid values are %s", name, strings.Join(validNames, ", ")))
		}
		ids = append(ids, id)
	}
	return ids, nil
}

func GetTlsVersion(tlsMinVersion string) (uint16, error) {

	validOption := validOption{
		tlsOption: map[string]uint16{
			"1.0": tls.VersionTLS10,
			"1.1": tls.VersionTLS11,
			"1.2": tls.VersionTLS12,
			"1.3": tls.VersionTLS13,
		},
	}

	if _, ok := validOption.tlsOption[tlsMinVersion]; !ok {

View on GitHub (pinned to 35b8b99117)