{"record":{"id":"af1a07ac276eae7f","repo":"hashicorp/nomad","slug":"verifyincoming-set-and-no-cert-key-pair-provided","errorCode":null,"errorMessage":"VerifyIncoming set, and no Cert/Key pair provided!","messagePattern":"VerifyIncoming set, and no Cert/Key pair provided!","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"helper/tlsutil/config.go","lineNumber":372,"sourceCode":"\t\treturn nil, err\n\t}\n\n\t// Add cert/key\n\tcert, err := c.LoadKeyPair()\n\tif err != nil {\n\t\treturn nil, err\n\t} else if cert != nil {\n\t\ttlsConfig.GetCertificate = c.KeyLoader.GetOutgoingCertificate\n\t}\n\n\t// Check if we require verification\n\tif c.VerifyIncoming {\n\t\ttlsConfig.ClientAuth = tls.RequireAndVerifyClientCert\n\t\tif c.CAFile == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"VerifyIncoming set, and no CA certificate provided!\")\n\t\t}\n\t\tif cert == nil {\n\t\t\treturn nil, fmt.Errorf(\"VerifyIncoming set, and no Cert/Key pair provided!\")\n\t\t}\n\t}\n\n\treturn tlsConfig, nil\n}\n\n// ParseCiphers parses ciphersuites from the comma-separated string into\n// recognized slice\nfunc ParseCiphers(tlsConfig *config.TLSConfig) ([]uint16, error) {\n\tsuites := []uint16{}\n\n\tcipherStr := strings.TrimSpace(tlsConfig.TLSCipherSuites)\n\n\tvar parsedCiphers []string\n\tif cipherStr == \"\" {\n\t\tparsedCiphers = defaultTLSCiphers\n\n\t} else {","sourceCodeStart":354,"sourceCodeEnd":390,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/helper/tlsutil/config.go#L354-L390","documentation":"IncomingTLSConfig requires the server itself to present a certificate when VerifyIncoming is set; if no certificate was successfully loaded (cert == nil), the config is rejected. A server enforcing client verification must also authenticate itself to clients.","triggerScenarios":"Calling IncomingTLSConfig with VerifyIncoming=true but with CertFile/KeyFile empty, or with a cert that failed to load earlier (e.g. LoadKeyPair errored silently leaving cert nil).","commonSituations":"Setting verify_incoming = true but forgetting cert_file/key_file; typo'd cert paths causing the pair not to load; configs migrated from HTTP-only setups.","solutions":["Set cert_file and key_file in the tls stanza to a valid PEM cert/key pair.","Check that both files exist, are readable, and the key matches the certificate.","If client verification isn't intended, remove verify_incoming = true."],"exampleFix":"// before\ncfg := &tlsutil.Config{ VerifyIncoming: true, CAFile: \"ca.pem\" }\n// after\ncfg := &tlsutil.Config{ VerifyIncoming: true, CAFile: \"ca.pem\", CertFile: \"server.pem\", KeyFile: \"server-key.pem\" }","handlingStrategy":"validation","validationCode":"if cfg.VerifyIncoming && (cfg.CertFile == \"\" || cfg.KeyFile == \"\") {\n    return errors.New(\"verify_incoming requires cert_file and key_file\")\n}\nif _, err := tls.LoadX509KeyPair(cfg.CertFile, cfg.KeyFile); err != nil {\n    return err\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set cert_file/key_file together with verify_incoming.","Test cert/key loading with a pre-flight LoadX509KeyPair.","Ensure file permissions allow the service user to read both files."],"tags":["tls","mtls","certificate"],"backgroundTag":"tls-missing-cert-key-pair","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}