What causes "invalid TLS version: %s, valid values are %s" in thanos-io/thanos?

Set the value to exactly one of: 1.0, 1.1, 1.2, 1.3.

invalid TLS version: , valid values are

Error message

invalid TLS version: %s, valid values are %s

What it means

GetTlsVersion converts a human-readable minimum TLS version string ("1.0".."1.3") into Go's uint16 tls.Version* constants. Any other string returns this error listing the valid values. It validates the min TLS version option for both server and client configs.

Solutions

Set the value to exactly one of: 1.0, 1.1, 1.2, 1.3.
Fix the env var/flag, e.g. TLS_MIN_VERSION=1.2.
Add a default ("1.2") when the variable is empty before calling.
Normalize other naming schemes before passing (strip "TLS", "v").

Example fix

# before
export TLS_MIN_VERSION=TLSv1.2
# after
export TLS_MIN_VERSION=1.2

Defensive patterns

Strategy: validation

Validate before calling

var validTLSVersions = map[string]bool{"1.0": true, "1.1": true, "1.2": true, "1.3": true}
func checkTLSVersion(v string) error {
    if !validTLSVersions[v] {
        return fmt.Errorf("TLS version must be one of 1.0, 1.1, 1.2, 1.3, got %q", v)
    }
    return nil
}

Try / catch

_, err := tls.GetTlsVersion(minTLSVersion)
if err != nil {
    return fmt.Errorf("%s_min_version invalid, use 1.2 or 1.3: %w", prefix, err)
}

Prevention

Default to "1.2" when the env var is unset.
Accept only the plain forms 1.0/1.1/1.2/1.3.
Normalize inputs like "TLSv1.2" to "1.2" upstream.
Add the version field to config validation at startup.

When it happens

Trigger: NewServerConfig or NewClientConfig (via StoreClientTLSCredentials) is passed minTLSVersion values like "TLS12", "tls1.2", "1", "12", or empty string.

Common situations: Env var TLS_MIN_VERSION set to "TLSv1.2" style naming from other tools; empty/unset variable not defaulted; config copied from a library that uses "VersionTLS12" identifiers; shell quoting dropping part of the value.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of thanos-io/thanos@35b8b99117 (2026-09-07). Data as JSON: /api/errors/fefe4760dfc52e35. Report an issue: GitHub.

Appendix: source

Thrown at pkg/tls/options.go:317

		}
		ids = append(ids, id)
	}
	return ids, nil
}

func GetTlsVersion(tlsMinVersion string) (uint16, error) {

	validOption := validOption{
		tlsOption: map[string]uint16{
			"1.0": tls.VersionTLS10,
			"1.1": tls.VersionTLS11,
			"1.2": tls.VersionTLS12,
			"1.3": tls.VersionTLS13,
		},
	}

	if _, ok := validOption.tlsOption[tlsMinVersion]; !ok {
		return 0, errors.New(fmt.Sprintf("invalid TLS version: %s, valid values are %s", tlsMinVersion, validOption.joinString()))
	}

	return validOption.tlsOption[tlsMinVersion], nil
}

View on GitHub (pinned to 35b8b99117)