{"record":{"id":"52a38ee0768a8608","repo":"hashicorp/nomad","slug":"consul-linked-service-tls-sni-requires-cafile","errorCode":null,"errorMessage":"Consul Linked Service TLS SNI requires CAFile","messagePattern":"Consul Linked Service TLS SNI requires CAFile","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/services.go","lineNumber":2650,"sourceCode":"\tif s.Name == \"\" {\n\t\treturn fmt.Errorf(\"Consul Linked Service requires Name\")\n\t}\n\n\tcaSet := s.CAFile != \"\"\n\tcertSet := s.CertFile != \"\"\n\tkeySet := s.KeyFile != \"\"\n\tsniSet := s.SNI != \"\"\n\n\tif (certSet || keySet) && !caSet {\n\t\treturn fmt.Errorf(\"Consul Linked Service TLS requires CAFile\")\n\t}\n\n\tif certSet != keySet {\n\t\treturn fmt.Errorf(\"Consul Linked Service TLS Cert and Key must both be set\")\n\t}\n\n\tif sniSet && !caSet {\n\t\treturn fmt.Errorf(\"Consul Linked Service TLS SNI requires CAFile\")\n\t}\n\n\treturn nil\n}\n\nfunc linkedServicesEqual(a, b []*ConsulLinkedService) bool {\n\treturn helper.ElementsEqual(a, b)\n}\n\ntype ConsulTerminatingConfigEntry struct {\n\tServices []*ConsulLinkedService\n}\n\nfunc (e *ConsulTerminatingConfigEntry) Copy() *ConsulTerminatingConfigEntry {\n\tif e == nil {\n\t\treturn nil\n\t}\n","sourceCodeStart":2632,"sourceCodeEnd":2668,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/services.go#L2632-L2668","documentation":"ConsulLinkedService.Validate: sni was set on a linked service without ca_file. SNI only makes sense when TLS with a CA is configured, so it is rejected when CAFile is absent.","triggerScenarios":"Thrown at nomad/structs/services.go:2650 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Add ca_file alongside sni","Remove sni if not using TLS"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}