{"record":{"id":"1b2cfeb48468c4e1","repo":"hashicorp/nomad","slug":"request-certificate-is-only-valid-for-s-v","errorCode":null,"errorMessage":"request certificate is only valid for %s: %v","messagePattern":"request certificate is only valid for (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/rpc.go","lineNumber":922,"sourceCode":"\t\t}\n\t}\n\treturn err\n}\n\nfunc (r *rpcHandler) validateRaftTLS(rpcCtx *RPCContext) error {\n\t// TLS is not configured or not to be enforced\n\ttlsConf := r.srv.config.TLSConfig\n\tif !tlsConf.EnableRPC || !tlsConf.VerifyServerHostname || tlsConf.RPCUpgradeMode {\n\t\treturn nil\n\t}\n\n\t// check that `server.<region>.nomad` is present in cert\n\texpected := \"server.\" + r.srv.Region() + \".nomad\"\n\terr := rpcCtx.ValidateCertificateForName(expected)\n\tif err != nil {\n\t\tcert := rpcCtx.Certificate()\n\t\tif cert != nil {\n\t\t\terr = fmt.Errorf(\"request certificate is only valid for %s: %v\", cert.DNSNames, err)\n\t\t}\n\n\t\treturn fmt.Errorf(\"unauthorized raft connection from %s: %v\", rpcCtx.Conn.RemoteAddr(), err)\n\t}\n\n\t// Certificate is valid for the expected name\n\treturn nil\n}\n","sourceCodeStart":904,"sourceCodeEnd":931,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/rpc.go#L904-L931","documentation":"During raft TLS validation, handleConn/validateRaftTLS requires the peer's certificate to be valid for server.<region>.nomad. When ValidateCertificateForName fails and a certificate is present, the name-mismatch error is wrapped with this message listing the DNS names the certificate IS valid for, to ease diagnosing cert/region mismatches.","triggerScenarios":"A server-to-server connection whose certificate's SANs/CN do not include server.<local-region>.nomad — certs issued for a different region, client-role certs used for server connections, or misconfigured region names.","commonSituations":"Adding a new region without re-issuing certs; copying certs from another region; region renamed in config but certificates still use the old name; CA automation templates lacking the right SAN.","solutions":["Re-issue the peer's certificate including DNS SAN server.<region>.nomad for the local region","Verify region config matches certificate names on both servers (`openssl x509 -text`)","Use a CA template that generates region-scoped SANs for server certs","Replace any client-role certificates being used on server RPC ports"],"exampleFix":"// before\nsubjectAltName=DNS:server.us-west-1.nomad   # used in us-east-1 region\n// after\nsubjectAltName=DNS:server.us-east-1.nomad   # matches server region config","handlingStrategy":"validation","validationCode":"cert, _ := tls.LoadX509Certificate(\"server.pem\")\nexpected := \"server.\" + region + \".nomad\"\nif !slices.Contains(append([]string{cert.Subject.CommonName}, cert.DNSNames...), expected) {\n    return fmt.Errorf(\"cert must include SAN %s\", expected)\n}","typeGuard":"func validForRaftTLS(cert *x509.Certificate, region string) bool {\n    return certCoversName(cert, \"server.\"+region+\".nomad\")\n}","tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"request certificate is only valid for\") {\n    return fmt.Errorf(\"re-issue server cert with SAN server.<region>.nomad: %w\", err)\n}","preventionTips":["Include server.<region>.nomad in every server cert's SANs","Audit SANs after region changes","Use CA automation that derives SANs from region config"],"tags":["nomad","tls","certificate","raft","security"],"backgroundTag":"certificate-name-mismatch","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}