{"record":{"id":"7f378d0bbf807f86","repo":"hashicorp/nomad","slug":"failed-to-configure-tls-w","errorCode":null,"errorMessage":"failed to configure TLS: %w","messagePattern":"failed to configure TLS: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"command/operator_debug.go","lineNumber":1329,"sourceCode":"\t// Exit if we are unable to retrieve the leader\n\terr = c.collectConsulAPIRequest(client, \"/v1/status/leader\", dir, \"consul-leader.json\")\n\tif err != nil {\n\t\tc.Ui.Output(fmt.Sprintf(\"Unable to contact Consul leader, skipping: %s\", err))\n\t\treturn\n\t}\n\n\tc.collectConsulAPI(client, \"/v1/agent/host\", dir, \"consul-agent-host.json\")\n\tc.collectConsulAPI(client, \"/v1/agent/members\", dir, \"consul-agent-members.json\")\n\tc.collectConsulAPI(client, \"/v1/agent/metrics\", dir, \"consul-agent-metrics.json\")\n\tc.collectConsulAPI(client, \"/v1/agent/self\", dir, \"consul-agent-self.json\")\n}\n\nfunc (c *OperatorDebugCommand) consulAPIClient() (*http.Client, error) {\n\thttpClient := defaultHttpClient()\n\n\terr := api.ConfigureTLS(httpClient, c.consul.tls)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to configure TLS: %w\", err)\n\t}\n\n\treturn httpClient, nil\n}\n\nfunc (c *OperatorDebugCommand) collectConsulAPI(client *http.Client, urlPath string, dir string, file string) {\n\terr := c.collectConsulAPIRequest(client, urlPath, dir, file)\n\tif err != nil {\n\t\tc.Ui.Error(fmt.Sprintf(\"Error collecting from Consul API: %s\", err.Error()))\n\t}\n}\n\nfunc (c *OperatorDebugCommand) collectConsulAPIRequest(client *http.Client, urlPath string, dir string, file string) error {\n\turl := c.consul.addrVal + urlPath\n\n\treq, err := http.NewRequest(http.MethodGet, url, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create HTTP request for Consul API URL=%q: %w\", url, err)","sourceCodeStart":1311,"sourceCodeEnd":1347,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/operator_debug.go#L1311-L1347","documentation":"consulAPIClient builds the HTTP client used to scrape Consul API endpoints during a debug capture. It delegates TLS setup to api.ConfigureTLS with the command's parsed Consul TLS options; any failure (unreadable cert/key files, bad CA path, invalid certificate material) is wrapped with this message and aborts client creation, so collectConsul cannot gather API data.","triggerScenarios":"api.ConfigureTLS(httpClient, c.consul.tls) errors because the TLS config references files that don't exist or can't be read (-http-ssl-cert, -http-ssl-key, -http-ssl-ca), the cert/key pair is invalid, or the CA doesn't parse.","commonSituations":"Typos in certificate file paths passed to consul operator debug; cert files not readable by the current user; expired or malformed PEM files; enabling SSL options against an agent that needs client certs.","solutions":["Read the wrapped cause — ConfigureTLS names the offending file or parse failure","Verify each TLS file path exists and is readable: ls -l on the -http-ssl-ca/-cert/-key values","Regenerate or re-export damaged/expired certs; ensure key and cert match (openssl x509/rsa modulus compare)","If the local agent doesn't require TLS, drop the SSL flags so defaultHttpClient is used unmodified"],"exampleFix":"// before\nconsul operator debug -http-ssl -http-ssl-cert=/wrong/path/cert.pem\n// after\nconsul operator debug -http-ssl -http-ssl-ca=/etc/consul/tls/ca.pem -http-ssl-cert=/etc/consul/tls/cli.pem -http-ssl-key=/etc/consul/tls/cli-key.pem","handlingStrategy":"validation","validationCode":"for _, p := range []string{caPath, certPath, keyPath} {\n\tif p != \"\" {\n\t\tif _, err := os.ReadFile(p); err != nil {\n\t\t\treturn fmt.Errorf(\"TLS file %s unreadable: %w\", p, err)\n\t\t}\n\t}\n}","typeGuard":null,"tryCatchPattern":"client, err := buildConsulClient(tlsCfg)\nif err != nil {\n\tif strings.Contains(err.Error(), \"failed to configure TLS\") {\n\t\t// inspect wrapped cause, fix cert/key/CA paths, then retry\n\t}\n\treturn err\n}","preventionTips":["Pre-flight check existence and readability of every -http-ssl-* file before running","Ensure cert/key pairs match and PEMs are valid (openssl verify)","Drop SSL flags when capturing from a plaintext local agent"],"tags":["tls","http-client","consul-api","configuration"],"backgroundTag":"tls-config-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}