{"record":{"id":"4a43859e99450deb","repo":"hashicorp/nomad","slug":"organizational-unit-value-not-provided","errorCode":null,"errorMessage":"organizational unit value not provided","messagePattern":"organizational unit value not provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"helper/tlsutil/generate.go","lineNumber":153,"sourceCode":"\t\topts.Days = 1825\n\t}\n\n\tif opts.IsCustom() {\n\t\tif opts.Name == \"\" {\n\t\t\treturn \"\", \"\", errors.New(\"common name value not provided\")\n\t\t} else {\n\t\t\topts.Name = fmt.Sprintf(\"%s %d\", opts.Name, sn)\n\t\t}\n\t\tif opts.Country == \"\" {\n\t\t\treturn \"\", \"\", errors.New(\"country value not provided\")\n\t\t}\n\n\t\tif opts.Organization == \"\" {\n\t\t\treturn \"\", \"\", errors.New(\"organization value not provided\")\n\t\t}\n\n\t\tif opts.OrganizationalUnit == \"\" {\n\t\t\treturn \"\", \"\", errors.New(\"organizational unit value not provided\")\n\t\t}\n\t} else {\n\t\topts.Name = fmt.Sprintf(\"Nomad Agent CA %d\", sn)\n\t\topts.Country = \"US\"\n\t\topts.PostalCode = \"94105\"\n\t\topts.Province = \"CA\"\n\t\topts.Locality = \"San Francisco\"\n\t\topts.StreetAddress = \"101 Second Street\"\n\t\topts.Organization = \"HashiCorp Inc.\"\n\t\topts.OrganizationalUnit = \"Nomad\"\n\t}\n\n\t// Create the CA cert\n\ttemplate := x509.Certificate{\n\t\tSerialNumber: sn,\n\t\tSubject: pkix.Name{\n\t\t\tCountry:            []string{opts.Country},\n\t\t\tPostalCode:         []string{opts.PostalCode},","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/helper/tlsutil/generate.go#L135-L171","documentation":"Fires in GenerateCA for a custom CA (IsCustom) whose OrganizationalUnit is empty; the custom subject requires all fields (name, country, organization, OU) to be set before generation proceeds.","triggerScenarios":"tlsutil.GenerateCA with IsCustom() true and opts.OrganizationalUnit empty — checked after Name, Country, and Organization.","commonSituations":"Scripts that populate name/country/organization but omit the OU (e.g. --organizational-unit); config structs copied from examples that skip OU.","solutions":["Set opts.OrganizationalUnit when using custom CA options","Or use default (non-custom) CA generation"],"exampleFix":"// before\nopts := &tlsutil.CAConfig{Name: \"Nomad CA\", Country: \"US\", Organization: \"HashiCorp\"} // OU missing\n// after\nopts := &tlsutil.CAConfig{Name: \"Nomad CA\", Country: \"US\", Organization: \"HashiCorp\", OrganizationalUnit: \"Engineering\"}","handlingStrategy":"validation","validationCode":"if opts.IsCustom() && opts.OrganizationalUnit == \"\" {\n    return errors.New(\"custom CA requires an OrganizationalUnit\")\n}\nca, key, err := tlsutil.GenerateCA(opts)","typeGuard":"func hasOrganizationalUnit(opts *tlsutil.CAConfig) bool { return opts.OrganizationalUnit != \"\" }","tryCatchPattern":"ca, key, err := tlsutil.GenerateCA(opts)\nif err != nil {\n    if strings.Contains(err.Error(), \"organizational unit value not provided\") {\n        return fmt.Errorf(\"set 'organizational_unit' in custom TLS config: %w\", err)\n    }\n    return err\n}","preventionTips":["Set OrganizationalUnit whenever custom CA subject fields are used.","Write a single preflight validator for Name/Country/Organization/OrganizationalUnit.","Fall back to default CA generation when only partial subject data exists."],"tags":["tls","x509","config-validation"],"backgroundTag":"missing-required-tls-field","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}