I am using virt-install (see below) to create a guest. All seems fine up to the point where it complains about auto-allocation of the SPICE TLS port.

Here's what I am running and the full output:

# sudo virt-install --name vmname --ram 1024 --os-type=linux --os-variant=ubuntutrusty --disk path=/data/vm/vmname_sda.qcow2,bus=virtio,size=10,sparse=false --noautoconsole --console pty,target_type=virtio --accelerate --hvm --network=network:default --graphics spice,port=20001,listen=

Starting install...
Retrieving file MANIFEST...                                                                                  | 2.1 kB     00:00 ...
Retrieving file MANIFEST...                                                                                  | 2.1 kB     00:00 ...
Retrieving file linux...                                                                                     |  11 MB     00:00 ...
Retrieving file initrd.gz...                                                                                 |  41 MB     00:00 ...
ERROR    unsupported configuration: Auto allocation of spice TLS port requested but spice TLS is disabled in qemu.conf
Domain installation does not appear to have been successful.
If it was, you can restart your domain by running:
  virsh --connect qemu:///system start vmname
otherwise, please restart your installation.

The error is:

ERROR unsupported configuration: Auto allocation of spice TLS port requested but spice TLS is disabled in qemu.conf

and indeed in my /etc/libvirt/qemu.conf I have:

spice_tls = 0

(and intentionally so).

So how can I create a KVM guest using the SPICE protocol for graphics, but with TLS disabled?

I doubt it is of relevance, but the reason I want to disable TLS is because I am tunneling the connection to SPICE via SSH already. No need for an extra layer of encryption.

The host system is Ubuntu 14.04.1. Package versions are:

  • virtinst: 0.600.4-3ubuntu2
  • qemu-kvm: 2.0.0+dfsg-2ubuntu1.2

(all up to date as far as apt-get is concerned)

4 Answers 4


Okay, I worked around it on my own. In the option:

--graphics spice,port=20001,listen=

remove the port parameter such that it becomes:

--graphics spice,listen=

You need to configure the <graphics /> element in the libvirt XML configuration file then. My invocation of virt-install gave me this:

<graphics type='spice' autoport='yes' listen=''>
  <listen type='address' address=''/>

There is one caveat. I finished the installation while SPICE was still connected to the default auto-connected port (5900 in my case). If you shut down the guest prior to finishing the installation the whole process initiated by virt-install will be interrupted.

In order to change it one should shut down the guest and the edit the XML to something like the following, using virsh edit vmname (where vmname should be replaced with your name):

<graphics type='spice' autoport='no' port='20001' listen=''>
  <listen type='address' address=''/>

Possible workaround for "port in use" conflicts. Use any of the local net addresses other than from, e.g. etc to listen on.

NOTE: If someone can come up with a better (i.e. actual) solution, I'll accept that other answer. This writeup is mostly for others that may run into the same issue.


When the convenient arguments to virt-install fail, it is possible to instead manually craft the xml using XPath syntax.

Replacing --graphics "spice,port=20001,defaultMode=insecure,autoport=no" with these five argument pairs was a successful workaround for me:

    --xml 'xpath.delete=./devices/graphics' \
    --xml './devices/graphics/@defaultMode=insecure' \
    --xml './devices/graphics/@autoport=no' \
    --xml './devices/graphics/@type=spice' \
    --xml "./devices/graphics/@port=20001"

Those of us who are curious of the generated xml may add the --print-xml option.

  • 1
    It works for me. Awesome!
    – Bin S
    Jan 17, 2022 at 17:40

the solution is to tell kvm/virt to use as default an insecure connection.

<graphics type='spice' autoport='yes' listen='' defaultMode='insecure'>
  <listen type='address' address=''/>

Set the defaultMode to insecure and you can use even autoport='yes' and everything is fine.

One hint, when you search the port, you have to use domdisplay:

[root@kvm repo]# virsh domdisplay --domain openshift1

I don't know if this is a bug or correct behavior, but the output of virsh domdisplay --domain openshift1 shows localhost instead of But you can connect from external with the server-ip/dns to your guest vm's. Be sure the firewall let you connect to these ports and even kvm/virt does listen to like shown above.


If this helps...

listen=,  <-- listen on any interface
port=5962, <-- specify non-secure port
tlsport=,  <-- do not request TLS
defaultMode='insecure'  <-- allow insecure
virt-install \
    --graphics spice,listen=,port=5962,tlsport=,defaultMode='insecure' \

Resulting XML:

    <graphics type='spice' port='5962' autoport='no' listen='' defaultMode='insecure'>
      <listen type='address' address=''/>
      <image compression='off'/>
  • This did not work for me (on Debian 10 ("buster"), libvirt version 5.0.0), I still get the mentioned error. Jan 10, 2022 at 15:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .