{"record":{"id":"6ea962f601703b4b","repo":"hashicorp/nomad","slug":"could-not-read-jwks-certfile-v-6ea962","errorCode":null,"errorMessage":"could not read -jwks-certfile: %v","messagePattern":"could not read -jwks-certfile: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"command/setup_vault.go","lineNumber":513,"sourceCode":"func (s *SetupVaultCommand) authMethodExists() bool {\n\texistingConf, _ := s.vLogical.Read(fmt.Sprintf(\"/auth/%s/config\", vaultPath))\n\treturn existingConf != nil\n}\n\nfunc (s *SetupVaultCommand) renderAuthMethod() (map[string]any, error) {\n\tauthConfig := map[string]any{}\n\terr := json.Unmarshal(vaultAuthConfigBody, &authConfig)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"default auth config text could not be deserialized: %v\", err)\n\t}\n\n\tauthConfig[\"jwks_url\"] = s.jwksURL\n\tauthConfig[\"default_role\"] = vaultRole\n\n\tif s.jwksCACertPath != \"\" {\n\t\tcaCert, err := os.ReadFile(s.jwksCACertPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not read -jwks-certfile: %v\", err)\n\t\t}\n\t\tauthConfig[\"jwks_ca_pem\"] = string(caCert)\n\t}\n\n\treturn authConfig, nil\n}\n\nfunc (s *SetupVaultCommand) createAuthMethod(authConfig map[string]any) error {\n\terr := s.vClient.Sys().EnableAuthWithOptions(vaultPath, &api.MountInput{Type: \"jwt\"})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"[✘] Could not enable JWT credential backend: %w\", err)\n\t}\n\n\tbuf, err := json.Marshal(authConfig)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"auth method could not be interpolated with args: %w\", err)\n\t}\n\t_, err = s.vLogical.WriteBytes(fmt.Sprintf(\"auth/%s/config\", vaultPath), buf)","sourceCodeStart":495,"sourceCodeEnd":531,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/setup_vault.go#L495-L531","documentation":"When -jwks-certfile is provided, renderAuthMethod reads the CA cert file to embed as jwks_ca_pem in the auth config. If os.ReadFile fails (missing file, no permissions, path is a directory), this error is returned.","triggerScenarios":"os.ReadFile(s.jwksCACertPath) errors: file does not exist, insufficient read permission, or path points to a directory.","commonSituations":"Typo in the -jwks-certfile path; passing the JWKS URL's leaf cert instead of the CA bundle; file generated after this step ran; running in a container without the cert mounted.","solutions":["Verify the file path passed to -jwks-certfile exists and is readable by the current user","Pass the CA certificate (or bundle) that signed the JWKS endpoint, not the leaf cert","In containers, mount the cert file into the pod/container","Use an absolute path rather than a relative one"],"exampleFix":"// before\nnomad setup -jwks-certfile=./jwks-ca.pem\n// after\nnomad setup -jwks-certfile=$(pwd)/jwks-ca.pem  # path verified with ls -l first","handlingStrategy":"validation","validationCode":"if s.jwksCACertPath != \"\" {\n    if fi, err := os.Stat(s.jwksCACertPath); err != nil || fi.IsDir() {\n        return nil, fmt.Errorf(\"-jwks-certfile not a readable file: %s\", s.jwksCACertPath)\n    }\n}","typeGuard":null,"tryCatchPattern":"if _, err := os.ReadFile(path); err != nil && os.IsNotExist(err) { /* fix path before rerun */ }","preventionTips":["Use absolute paths for -jwks-certfile","Verify with ls -l that the file exists and is readable","Pass the CA/bundle, not the leaf certificate","Mount certs into containers before running setup"],"tags":["file-io","filesystem","certificate","flags"],"backgroundTag":"file-not-found","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}