{"record":{"id":"4dc7a7b70c51d137","repo":"thanos-io/thanos","slug":"could-not-get-organization-field-from-client-cert","errorCode":null,"errorMessage":"could not get organization field from client cert","messagePattern":"could not get organization field from client cert","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/tenancy/tenancy.go","lineNumber":112,"sourceCode":"}\n\n// getTenantFromCertificate extracts the tenant value from a client's presented certificate. The x509 field to use as\n// value can be configured with Options.TenantField. An error is returned when the extraction has not succeeded.\nfunc getTenantFromCertificate(r *http.Request, certTenantField string) (string, error) {\n\tvar tenant string\n\n\tif len(r.TLS.PeerCertificates) == 0 {\n\t\treturn \"\", errors.New(\"could not get required certificate field from client cert\")\n\t}\n\n\t// First cert is the leaf authenticated against.\n\tcert := r.TLS.PeerCertificates[0]\n\n\tswitch certTenantField {\n\n\tcase CertificateFieldOrganization:\n\t\tif len(cert.Subject.Organization) == 0 {\n\t\t\treturn \"\", errors.New(\"could not get organization field from client cert\")\n\t\t}\n\t\ttenant = cert.Subject.Organization[0]\n\n\tcase CertificateFieldOrganizationalUnit:\n\t\tif len(cert.Subject.OrganizationalUnit) == 0 {\n\t\t\treturn \"\", errors.New(\"could not get organizationalUnit field from client cert\")\n\t\t}\n\t\ttenant = cert.Subject.OrganizationalUnit[0]\n\n\tcase CertificateFieldCommonName:\n\t\tif cert.Subject.CommonName == \"\" {\n\t\t\treturn \"\", errors.New(\"could not get commonName field from client cert\")\n\t\t}\n\t\ttenant = cert.Subject.CommonName\n\n\tdefault:\n\t\treturn \"\", errors.New(\"tls client cert field requested is not supported\")\n\t}","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/pkg/tenancy/tenancy.go#L94-L130","documentation":"This error comes from getTenantFromCertificate in pkg/tenancy when Thanos extracts a tenant ID from a client TLS certificate. It is thrown when the certificate's Subject.Organization field is empty even though the tenancy configuration specifies 'organization' as the cert field to use for tenant identification. The request is rejected because no tenant can be derived.","triggerScenarios":"GetTenantFromHTTP is called with certTenantField=CertificateFieldOrganization on an mTLS request whose client certificate has no Organization (O) attribute in its Subject.","commonSituations":"Client certificates issued without the O field populated (common with internal PKI or cert-manager-generated certs); server configured with --tenant-certificate-field=organization while clients present certs carrying only OU or CN; migration between certificate authorities with different subject templates.","solutions":["Set the Organization field in the client certificate Subject and reissue/re-sign the cert (e.g. openssl -subj '/O=my-tenant/CN=client')","Alternatively configure the server to read a field the cert actually has, e.g. --tenant-certificate-field=organizationalUnit or common-name","Verify the presented cert with 'openssl x509 -in client.crt -noout -subject' to confirm which fields exist","Ensure the proxy is receiving the leaf client cert (TLS client auth enabled and PeerCertificates populated)"],"exampleFix":"// before\nopenssl req -new -newkey rsa:2048 -nodes -keyout client.key -out client.csr -subj '/CN=client'\n// after\nopenssl req -new -newkey rsa:2048 -nodes -keyout client.key -out client.csr -subj '/O=my-tenant/CN=client'","handlingStrategy":"validation","validationCode":"// Go, before connecting\nif len(cert.Subject.Organization) == 0 {\n    return errors.New(\"client cert must have Organization set for tenancy\")\n}","typeGuard":"func certHasOrganization(cert *x509.Certificate) bool {\n    return cert != nil && len(cert.Subject.Organization) > 0\n}","tryCatchPattern":null,"preventionTips":["Standardize cert issuance templates to always include the tenant in the configured field","Run 'openssl x509 -noout -subject' against issued certs in CI","Align --tenant-certificate-field with the fields your CA actually populates"],"tags":["tls","tenancy","certificate","mtls"],"backgroundTag":"empty-required-field","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}