def check_tls_mode(tls_mode):
    """Check that provided tls mode is valid and convert to canonical form.

    Args:
        tls_mode (string): One of 'on', 'off', 'starttls', or 'starttls-force'.
            If 'on', we use TLS for the initial session establishment.
            If 'off', no TLS is used (for connecting to a legacy manager that
            does not support TLS). If 'starttls', the connection is initially
            unencrypted and will then be upgraded to a TLS connection after the
            initial handshake when connecting to a remote manager.
            If 'starttls-force', the client will behave like starttls mode but
            the connection will be upgraded to TLS even when connecting to the
            manager on localhost.

    Returns (string): tls mode in canonical (lowercase) form.

    Raises:
        ValueError: an invalid tls mode was specified
    """
    tls_mode = tls_mode.lower()
    if tls_mode not in ['on', 'off', 'starttls', 'starttls-force']:
        raise ValueError(
            "tls mode must be one of 'on', 'off', 'starttls', or 'starttls-force'. got: '{}'"
            .format(tls_mode))
    return tls_mode
