{"record":{"id":"8b139f02d9e83784","repo":"hashicorp/nomad","slug":"country-value-not-provided","errorCode":null,"errorMessage":"country value not provided","messagePattern":"country value not provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"helper/tlsutil/generate.go","lineNumber":145,"sourceCode":"\t\tvar err error\n\t\tsn, err = GenerateSerialNumber()\n\t\tif err != nil {\n\t\t\treturn \"\", \"\", err\n\t\t}\n\t}\n\n\tif opts.Days == 0 {\n\t\topts.Days = 1825\n\t}\n\n\tif opts.IsCustom() {\n\t\tif opts.Name == \"\" {\n\t\t\treturn \"\", \"\", errors.New(\"common name value not provided\")\n\t\t} else {\n\t\t\topts.Name = fmt.Sprintf(\"%s %d\", opts.Name, sn)\n\t\t}\n\t\tif opts.Country == \"\" {\n\t\t\treturn \"\", \"\", errors.New(\"country value not provided\")\n\t\t}\n\n\t\tif opts.Organization == \"\" {\n\t\t\treturn \"\", \"\", errors.New(\"organization value not provided\")\n\t\t}\n\n\t\tif opts.OrganizationalUnit == \"\" {\n\t\t\treturn \"\", \"\", errors.New(\"organizational unit value not provided\")\n\t\t}\n\t} else {\n\t\topts.Name = fmt.Sprintf(\"Nomad Agent CA %d\", sn)\n\t\topts.Country = \"US\"\n\t\topts.PostalCode = \"94105\"\n\t\topts.Province = \"CA\"\n\t\topts.Locality = \"San Francisco\"\n\t\topts.StreetAddress = \"101 Second Street\"\n\t\topts.Organization = \"HashiCorp Inc.\"\n\t\topts.OrganizationalUnit = \"Nomad\"","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/helper/tlsutil/generate.go#L127-L163","documentation":"Returned by GenerateCA when the certificate options are custom (IsCustom) but the Country field is empty. Custom CA subjects require a full distinguished name, so a missing country aborts certificate generation.","triggerScenarios":"tlsutil.GenerateCA with a CAConfig that has IsCustom() true (e.g. Name set) but Country empty — checked immediately after the Name check at generate.go:140.","commonSituations":"`nomad tls ca` invocations with custom name but no --country flag; TLS automation templates that fill Name but skip Country.","solutions":["Set opts.Country (two-letter country code) when using custom CA options","Or omit custom options so GenerateCA fills defaults (e.g. US)"],"exampleFix":"// before\nopts := &tlsutil.CAConfig{Name: \"Nomad CA\"} // Country missing\n// after\nopts := &tlsutil.CAConfig{Name: \"Nomad CA\", Country: \"US\"}","handlingStrategy":"validation","validationCode":"if opts.IsCustom() && opts.Country == \"\" {\n    return errors.New(\"custom CA requires a Country\")\n}\nca, key, err := tlsutil.GenerateCA(opts)","typeGuard":"func hasCountry(opts *tlsutil.CAConfig) bool { return opts.Country != \"\" }","tryCatchPattern":"ca, key, err := tlsutil.GenerateCA(opts)\nif err != nil {\n    if strings.Contains(err.Error(), \"country value not provided\") {\n        return fmt.Errorf(\"set 'country' in custom TLS config: %w\", err)\n    }\n    return err\n}","preventionTips":["Always pass a two-letter ISO country code with custom CA options.","Use a shared config struct/template that fills all subject fields together.","Test CA generation in CI to catch missing subject fields."],"tags":["tls","x509","config-validation"],"backgroundTag":"missing-required-tls-field","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}