{"record":{"id":"c184faba287f8414","repo":"hashicorp/nomad","slug":"could-not-read-jwks-certfile-v","errorCode":null,"errorMessage":"could not read -jwks-certfile: %v","messagePattern":"could not read -jwks-certfile: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"command/setup_consul.go","lineNumber":440,"sourceCode":"\t\texistingMethods,\n\t\tfunc(m *api.ACLAuthMethodListEntry) bool { return m.Name == authMethodName })\n}\n\nfunc (s *SetupConsulCommand) renderAuthMethod(name string, desc string) (*api.ACLAuthMethod, error) {\n\tauthConfig := map[string]any{}\n\terr := json.Unmarshal(consulAuthConfigBody, &authConfig)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"default auth config text could not be deserialized: %v\", err)\n\t}\n\n\tauthConfig[\"JWKSURL\"] = s.jwksURL\n\tauthConfig[\"BoundAudiences\"] = []string{consulAud}\n\tauthConfig[\"JWTSupportedAlgs\"] = []string{\"RS256\"}\n\n\tif s.jwksCACertPath != \"\" {\n\t\tcaCert, err := os.ReadFile(s.jwksCACertPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not read -jwks-certfile: %v\", err)\n\t\t}\n\t\tauthConfig[\"JWKSCACert\"] = string(caCert)\n\t}\n\n\tmethod := &api.ACLAuthMethod{\n\t\tName:          name,\n\t\tType:          \"jwt\",\n\t\tDisplayName:   name,\n\t\tDescription:   desc,\n\t\tTokenLocality: \"local\",\n\t\tConfig:        authConfig,\n\t}\n\tif s.consulEnt {\n\t\tmethod.NamespaceRules = []*api.ACLAuthMethodNamespaceRule{{\n\t\t\tSelector:      `\"consul_namespace\" in value`,\n\t\t\tBindNamespace: \"${value.consul_namespace}\",\n\t\t}}\n\t}","sourceCodeStart":422,"sourceCodeEnd":458,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/setup_consul.go#L422-L458","documentation":"renderAuthMethod optionally embeds a CA certificate for verifying the Nomad JWKS endpoint into the Consul auth method config. When -jwks-certfile (jwksCACertPath) is set, the file is read with os.ReadFile; any read failure (missing file, permissions, path errors) produces this wrapped error.","triggerScenarios":"`nomad setup consul -jwks-certfile /path/to/ca.pem` where the file does not exist, the path is wrong relative to the working directory, the process lacks read permission, or the argument points to a directory.","commonSituations":"Typo in the cert path; running the setup command from a different directory than expected with a relative path; the CA file was moved or deleted after generating it for Nomad's TLS config; permission issues when running nomad setup under a service account or container without the cert mounted.","solutions":["Verify the file exists at the given path (`ls -l <path>`) and use an absolute path in -jwks-certfile.","Fix permissions so the user running nomad setup can read the file (`chmod 644 /path/ca.pem`).","If the CA cert is unnecessary (TLS not used / JWKS served over HTTP), omit -jwks-certfile entirely.","Re-copy the CA certificate from the Nomad server if the file was removed (it is the same CA Nomad's TLS config uses)."],"exampleFix":"# before\nnomad setup consul -jwks-certfile ./ca.pem\n// after\nnomad setup consul -jwks-certfile /etc/nomad.d/tls/ca.pem  # absolute, existing path","handlingStrategy":"validation","validationCode":"if s.jwksCACertPath != \"\" {\n    if info, err := os.Stat(s.jwksCACertPath); err != nil {\n        return fmt.Errorf(\"-jwks-certfile %q not accessible: %v\", s.jwksCACertPath, err)\n    } else if info.IsDir() {\n        return fmt.Errorf(\"-jwks-certfile %q is a directory\", s.jwksCACertPath)\n    }\n}","typeGuard":null,"tryCatchPattern":"caCert, err := os.ReadFile(s.jwksCACertPath)\nif err != nil {\n    if os.IsNotExist(err) {\n        return fmt.Errorf(\"-jwks-certfile %q does not exist; check the path\", s.jwksCACertPath)\n    }\n    return fmt.Errorf(\"could not read -jwks-certfile: %v\", err)\n}","preventionTips":["Use absolute paths for -jwks-certfile, never paths relative to the current directory.","Check file existence and readability (ls -l) before running nomad setup.","In containers/service accounts, ensure the CA cert is mounted and readable by the running user.","Omit -jwks-certfile when the JWKS endpoint doesn't use TLS with a custom CA."],"tags":["consul","file-io","tls","setup"],"backgroundTag":"file-not-found","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}