{"record":{"id":"e1b1ca8668e18c3f","repo":"hashicorp/nomad","slug":"tls-server-name-may-only-be-set-for-consul-service","errorCode":null,"errorMessage":"tls_server_name may only be set for Consul service checks","messagePattern":"tls_server_name may only be set for Consul service checks","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/services.go","lineNumber":405,"sourceCode":"\n\t// success_before_passing is consul only\n\tif sc.SuccessBeforePassing != 0 {\n\t\treturn errors.New(\"success_before_passing may only be set for Consul service checks\")\n\t}\n\n\t// failures_before_critical is consul only\n\tif sc.FailuresBeforeCritical != 0 {\n\t\treturn errors.New(\"failures_before_critical may only be set for Consul service checks\")\n\t}\n\n\t// failures_before_warning is consul only\n\tif sc.FailuresBeforeWarning != 0 {\n\t\treturn errors.New(\"failures_before_warning may only be set for Consul service checks\")\n\t}\n\n\t// tls_server_name is consul only\n\tif sc.TLSServerName != \"\" {\n\t\treturn errors.New(\"tls_server_name may only be set for Consul service checks\")\n\t}\n\n\treturn nil\n}\n\n// validate a Service's ServiceCheck in the context of the Consul provider.\nfunc (sc *ServiceCheck) validateConsul() error {\n\tallowable := []string{ServiceCheckGRPC, ServiceCheckTCP, ServiceCheckHTTP, ServiceCheckScript}\n\tif err := sc.validateCommon(allowable); err != nil {\n\t\treturn err\n\t}\n\n\tcheckType := strings.ToLower(sc.Type)\n\n\t// Note that we cannot completely validate the Expose field yet - we do not\n\t// know whether this ServiceCheck belongs to a connect-enabled group-service.\n\t// Instead, such validation will happen in a job admission controller.\n\t//","sourceCodeStart":387,"sourceCodeEnd":423,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/services.go#L387-L423","documentation":"ServiceCheck.Validate in nomad/structs/services.go rejects TLSServerName on checks that are not Consul provider checks. The tls_server_name field configures SNI/hostname verification and is only forwarded to Consul; Nomad-native checks have no use for it. validateNomad is the provider-specific validation path, so setting the field there is a configuration error.","triggerScenarios":"Defining a task/group service check with provider = \"nomad\" (or default provider nomad) while setting check.tls_server_name to a non-empty value, then submitting/validating the job.","commonSituations":"Copying a check block that worked under Consul to a Nomad-provider service; teams migrating off Consul who keep the TLS tuning fields; templates that blanket-apply tls_server_name to all checks.","solutions":["Remove the tls_server_name field from checks on services that use the nomad provider","Switch the service's provider to \"consul\" if SNI hostname override is genuinely needed","Use check TLS-related options supported by nomad checks (e.g. tls_skip_verify) instead"],"exampleFix":"// before\ncheck {\n  type            = \"http\"\n  tls_server_name = \"my-service.service.consul\"\n}\n// after\ncheck {\n  type            = \"http\"\n  provider        = \"consul\"\n  tls_server_name = \"my-service.service.consul\"\n}","handlingStrategy":"validation","validationCode":"function checkTLSServerName(service) {\n  if ((service.provider ?? \"consul\") !== \"consul\") {\n    for (const c of service.checks ?? []) {\n      if (c.tls_server_name) throw new Error(`check on ${service.name}: tls_server_name is consul-only`);\n    }\n  }\n}","typeGuard":"function isConsulCheck(c) { return typeof c.tls_server_name === \"undefined\" || c.tls_server_name === \"\"; }","tryCatchPattern":"try {\n  await nomad.jobs.validate(job);\n} catch (e) {\n  if (e.message.includes(\"tls_server_name may only be set for Consul\")) {\n    console.error(\"Remove tls_server_name from nomad-provider checks\");\n  } else throw e;\n}","preventionTips":["Keep consul-only check fields (tls_server_name) in separate template fragments per provider","Run nomad job validate in CI before submitting jobs","When migrating providers, grep job files for tls_server_name"],"tags":["nomad","consul","service-check","tls","job-validation"],"backgroundTag":"unsupported-provider-option","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}