{"record":{"id":"99d8a23f358bcdda","repo":"hashicorp/nomad","slug":"verifyoutgoing-set-and-no-ca-certificate-provided","errorCode":null,"errorMessage":"VerifyOutgoing set, and no CA certificate provided!","messagePattern":"VerifyOutgoing set, and no CA certificate provided!","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"helper/tlsutil/config.go","lineNumber":239,"sourceCode":"\t\tc.VerifyOutgoing = true\n\t}\n\tif !c.VerifyOutgoing {\n\t\treturn nil, nil\n\t}\n\t// Create the tlsConfig\n\ttlsConfig := &tls.Config{\n\t\tRootCAs:            x509.NewCertPool(),\n\t\tInsecureSkipVerify: true,\n\t\tCipherSuites:       c.CipherSuites,\n\t\tMinVersion:         c.MinVersion,\n\t}\n\tif c.VerifyServerHostname {\n\t\ttlsConfig.InsecureSkipVerify = false\n\t}\n\n\t// Ensure we have a CA if VerifyOutgoing is set\n\tif c.VerifyOutgoing && c.CAFile == \"\" {\n\t\treturn nil, fmt.Errorf(\"VerifyOutgoing set, and no CA certificate provided!\")\n\t}\n\n\t// Parse the CA cert if any\n\terr := c.AppendCA(tlsConfig.RootCAs)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tcert, err := c.LoadKeyPair()\n\tif err != nil {\n\t\treturn nil, err\n\t} else if cert != nil {\n\t\ttlsConfig.GetCertificate = c.KeyLoader.GetOutgoingCertificate\n\t\ttlsConfig.GetClientCertificate = c.KeyLoader.GetClientCertificate\n\t}\n\n\treturn tlsConfig, nil\n}","sourceCodeStart":221,"sourceCodeEnd":257,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/helper/tlsutil/config.go#L221-L257","documentation":"OutgoingTLSConfig builds the tls.Config used for outbound connections. When VerifyOutgoing is enabled, Nomad will verify server certificates against a CA, so a CA file must be configured; otherwise verification is impossible and the agent refuses to build the TLS config. This is a startup/config-validation error, not a runtime network failure.","triggerScenarios":"Calling OutgoingTLSConfig (or OutgoingTLSWrapper) with a TLSConfig where VerifyOutgoing=true and CAFile==\"\" (i.e. verify_outgoing enabled in the agent config but no ca_file path set).","commonSituations":"Operators set verify_outgoing = true in the Nomad agent 'tls' stanza but forget to set ca_file; provisioning templates that enable verification without distributing the CA cert; moving from insecure to TLS setups mid-cluster.","solutions":["Set ca_file in the agent tls stanza (or TLSConfig.CAFile) to the PEM-encoded CA certificate path.","If mTLS verification is not needed yet, remove verify_outgoing = true (not recommended for production).","Ensure the CA file exists and is readable by the Nomad process before starting the agent."],"exampleFix":"// before\ntlsConfig := &tlsutil.Config{ VerifyOutgoing: true }\n// after\ntlsConfig := &tlsutil.Config{ VerifyOutgoing: true, CAFile: \"/etc/nomad.d/tls/ca.pem\" }","handlingStrategy":"validation","validationCode":"if cfg.VerifyOutgoing && cfg.CAFile == \"\" {\n    return errors.New(\"verify_outgoing requires ca_file to be set\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always ship ca_file alongside verify_outgoing in the tls stanza.","Template both settings together in config management.","Validate agent config in CI before deploy (run the agent's config check)."],"tags":["tls","configuration","ca-certificate"],"backgroundTag":"tls-verify-outgoing-missing-ca","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}