tursodatabase/turso · error · InvalidOperationException

Tls={actual} conflicts with the {scheme} URL scheme.

Error message

Tls={actual} conflicts with the {scheme} URL scheme.

What it means

ValidateTls() in TursoConnectionOptions enforces that an explicit 'Tls' connection-string value agrees with the URL scheme: https/wss imply TLS, http/ws imply plaintext. Setting Tls to the opposite of what the scheme already states is contradictory, so the provider refuses instead of guessing which one you meant. The libsql scheme itself never hits this because it resolves to http only when Tls=false.

Source

Thrown at bindings/dotnet/src/Turso.Data/TursoConnectionOptions.cs:190

               && IsRemoteScheme(uri.Scheme);
    }

    private static bool IsRemoteScheme(string scheme)
    {
        return scheme.Equals("libsql", StringComparison.OrdinalIgnoreCase)
               || scheme.Equals("turso", StringComparison.OrdinalIgnoreCase)
               || scheme.Equals("http", StringComparison.OrdinalIgnoreCase)
               || scheme.Equals("https", StringComparison.OrdinalIgnoreCase)
               || scheme.Equals("ws", StringComparison.OrdinalIgnoreCase)
               || scheme.Equals("wss", StringComparison.OrdinalIgnoreCase);
    }

    private string ValidateTls(string scheme, bool expectedTls, string? normalizedScheme = null)
    {
        if (Tls.HasValue && Tls.Value != expectedTls)
        {
            var actual = Tls.Value.ToString(CultureInfo.InvariantCulture);
            throw new InvalidOperationException($"Tls={actual} conflicts with the {scheme} URL scheme.");
        }

        return normalizedScheme ?? scheme;
    }
}

View on GitHub (pinned to 6c72522679)

Solutions

1. Remove the 'Tls' keyword entirely and let the URL scheme decide (https/wss = TLS on, http/ws = off).
2. If you truly need plaintext, change the URL scheme to http:// or ws:// to match 'Tls=false'.
3. If you need TLS, keep https:// or wss:// and drop 'Tls=false'.

Example fix

// before
Data Source=https://my-db.turso.io;Tls=false

// after (pick one)
Data Source=https://my-db.turso.io
Data Source=http://local-turso:8080;Tls=false

bool urlTls = dataSource.StartsWith("https://") || dataSource.StartsWith("wss://");
if (options.Tls is bool tls && tls != urlTls)
    throw new ConfigurationException("Remove the Tls keyword or align it with the URL scheme.");

When it happens

Trigger: 'Data Source=https://db.turso.io;Tls=false' (https with Tls disabled) or 'Data Source=http://host;Tls=true' (http with Tls required); likewise for ws/wss. Thrown when the connection is opened and GetRemoteUri() normalizes the scheme.

Common situations: Copy-pasting a Tls setting while switching the URL between http (local dev/emulator) and https (production); trying to disable TLS 'for testing' on an https endpoint; migrating from a client where Tls was a hint rather than a constraint.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Tls requires a remote Turso URL Data Source.
• Embedded replica connections are not supported yet by the .N
• Sync Interval requires embedded replica support, which is no
• Auth Token requires a remote Turso URL Data Source.
• Unknown encryption cipher: {cipher}

AI-assisted analysis of tursodatabase/turso@6c72522679 (2026-08-20). Data as JSON: /api/errors/f4f44e6258e9b119. Report an issue: GitHub.