{"record":{"id":"cb92a6f307d03487","repo":"hashicorp/nomad","slug":"common-name-value-not-provided","errorCode":null,"errorMessage":"common name value not provided","messagePattern":"common name value not provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"helper/tlsutil/generate.go","lineNumber":140,"sourceCode":"\tif err != nil {\n\t\treturn \"\", \"\", err\n\t}\n\n\tif sn == nil {\n\t\tvar err error\n\t\tsn, err = GenerateSerialNumber()\n\t\tif err != nil {\n\t\t\treturn \"\", \"\", err\n\t\t}\n\t}\n\n\tif opts.Days == 0 {\n\t\topts.Days = 1825\n\t}\n\n\tif opts.IsCustom() {\n\t\tif opts.Name == \"\" {\n\t\t\treturn \"\", \"\", errors.New(\"common name value not provided\")\n\t\t} else {\n\t\t\topts.Name = fmt.Sprintf(\"%s %d\", opts.Name, sn)\n\t\t}\n\t\tif opts.Country == \"\" {\n\t\t\treturn \"\", \"\", errors.New(\"country value not provided\")\n\t\t}\n\n\t\tif opts.Organization == \"\" {\n\t\t\treturn \"\", \"\", errors.New(\"organization value not provided\")\n\t\t}\n\n\t\tif opts.OrganizationalUnit == \"\" {\n\t\t\treturn \"\", \"\", errors.New(\"organizational unit value not provided\")\n\t\t}\n\t} else {\n\t\topts.Name = fmt.Sprintf(\"Nomad Agent CA %d\", sn)\n\t\topts.Country = \"US\"\n\t\topts.PostalCode = \"94105\"","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/helper/tlsutil/generate.go#L122-L158","documentation":"GenerateCA creates a self-signed CA certificate. When opts.IsCustom() is true, the caller must supply all certificate subject fields; an empty opts.Name (the common name) causes this error instead of falling back to Nomad defaults.","triggerScenarios":"Calling tlsutil.GenerateCA with CAConfig where IsCustom() is true (any of Name/Country/Organization/etc. set) but Name is left empty.","commonSituations":"Partially filled custom TLS config in `nomad tls ca` CLI or agent TLS setup — e.g. setting --country but forgetting --name; automated TLS provisioning scripts that pass a struct with only some fields.","solutions":["Provide opts.Name (common name), e.g. the cluster or CA name, when using custom CA options.","Or omit all custom fields so IsCustom() is false and Nomad generates default subject values.","Validate required custom fields (Name, Country, Organization, OrganizationalUnit) before calling GenerateCA."],"exampleFix":"// before\nca, key, err := tlsutil.GenerateCA(&tlsutil.CAConfig{Country: \"US\"}) // error: no Name\n// after\nca, key, err := tlsutil.GenerateCA(&tlsutil.CAConfig{Name: \"Nomad CA\", Country: \"US\"})","handlingStrategy":"validation","validationCode":"if opts.IsCustom() && opts.Name == \"\" {\n    return errors.New(\"custom CA requires a Name (common name)\")\n}\nca, key, err := tlsutil.GenerateCA(opts)","typeGuard":"func customCAComplete(opts *tlsutil.CAConfig) bool {\n    return opts.IsCustom() && opts.Name != \"\" && opts.Country != \"\" &&\n        opts.Organization != \"\" && opts.OrganizationalUnit != \"\"\n}","tryCatchPattern":"ca, key, err := tlsutil.GenerateCA(opts)\nif err != nil {\n    if strings.Contains(err.Error(), \"common name value not provided\") {\n        return fmt.Errorf(\"custom TLS config requires 'name': %w\", err)\n    }\n    return err\n}","preventionTips":["When setting any custom CA subject field, set all of Name/Country/Organization/OrganizationalUnit.","Prefer defaults (no custom fields) unless full subject data is available.","Validate the CAConfig struct before CLI/agent invocation."],"tags":["tls","x509","config-validation"],"backgroundTag":"missing-required-tls-field","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}