# HG changeset patch
# User Matthew Wild <mwild1@gmail.com>
# Date 1781265894 -3600
# Node ID 8f34af6a3821933a8275b62f6f7fde38375c2840
# Parent  7f4fcbb1bbe45f3abb2d659d89bd7eebe2684ac5
prosodyctl check: Validate tls_profile and tls_profile_version

diff -r 7f4fcbb1bbe4 -r 8f34af6a3821 util/prosodyctl/check.lua
--- a/util/prosodyctl/check.lua	Fri Jun 12 13:04:23 2026 +0100
+++ b/util/prosodyctl/check.lua	Fri Jun 12 13:04:54 2026 +0100
@@ -464,6 +464,7 @@
 			"statistics_interval",
 			"tcp_keepalives",
 			"tls_profile",
+			"tls_profile_version",
 			"trusted_proxies",
 			"umask",
 			"use_dane",
@@ -726,6 +727,26 @@
 		end
 
 		do
+			local tlsref = require "prosody.util.tlsref";
+			local tls_profile_name = configmanager.get("*", "tls_profile");
+			local tls_profile_version = configmanager.get("*", "tls_profile_version");
+			local profile, err = tlsref.get_profile(tls_profile_version, tls_profile_name);
+			if not profile then
+				print("");
+				print("    TLS profile selection:");
+				if err == "unknown-version" then
+					print(("        tls_profile_version is set to an unknown value (%q)"):format(tls_profile_version));
+					print(("        Valid values: \"%s\""):format(tlsref.get_valid_versions():concat("\", \"")));
+				elseif err == "unknown-profile" then
+					print(("        tls_profile is set to an unknown value (%q)"):format(tls_profile_name));
+					print(("        Valid values: \"%s\""):format(tlsref.get_valid_profile_names():concat("\", \"")));
+				else
+					print(("        Unknown error loading the configured profile: %s"):format(err));
+				end
+			end
+		end
+
+		do
 			local registration_enabled_hosts = {};
 			for host in enabled_hosts() do
 				local host_modules, component = modulemanager.get_modules_for_host(host);