{"record":{"id":"2816aa3dcf8388f3","repo":"hashicorp/nomad","slug":"failed-to-open-consul-tls-certificate-w","errorCode":null,"errorMessage":"failed to open consul TLS certificate: %w","messagePattern":"failed to open consul TLS certificate: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/taskrunner/connect_native_hook.go","lineNumber":153,"sourceCode":"\t\treturn err\n\t}\n\tif err := h.copyCertificate(consulConfig.CertFile, dir, secretCertfileFilename); err != nil {\n\t\treturn err\n\t}\n\tif err := h.copyCertificate(consulConfig.KeyFile, dir, secretKeyfileFilename); err != nil {\n\t\treturn err\n\t}\n\treturn nil\n}\n\nfunc (connectNativeHook) copyCertificate(source, dir, name string) error {\n\tif source == \"\" {\n\t\treturn nil\n\t}\n\n\toriginal, err := os.Open(source)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to open consul TLS certificate: %w\", err)\n\t}\n\tdefer original.Close()\n\n\tdestination := filepath.Join(dir, name)\n\tfd, err := os.Create(destination)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create secrets/%s: %w\", name, err)\n\t}\n\tdefer fd.Close()\n\n\tif _, err := io.Copy(fd, original); err != nil {\n\t\treturn fmt.Errorf(\"failed to copy certificate secrets/%s: %w\", name, err)\n\t}\n\n\tif err := fd.Sync(); err != nil {\n\t\treturn fmt.Errorf(\"failed to write secrets/%s: %w\", name, err)\n\t}\n","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/taskrunner/connect_native_hook.go#L135-L171","documentation":"connectNativeHook.copyCertificate failed to os.Open the Consul TLS cert file configured in the client's Consul block (file missing or unreadable) while copying TLS material into the task's secrets dir for Connect Native tasks.","triggerScenarios":"Thrown at client/allocrunner/taskrunner/connect_native_hook.go:153 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify cert_file/key_file/ca_file paths in the client's consul config exist","Check file read permissions for the Nomad client user","Fix or remove the TLS config if Consul uses no client certs"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}