{"record":{"id":"f9d4eab64bc3c104","repo":"hashicorp/nomad","slug":"consul-linked-service-tls-requires-cafile","errorCode":null,"errorMessage":"Consul Linked Service TLS requires CAFile","messagePattern":"Consul Linked Service TLS requires CAFile","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/services.go","lineNumber":2642,"sourceCode":"\treturn true\n}\n\nfunc (s *ConsulLinkedService) Validate() error {\n\tif s == nil {\n\t\treturn nil\n\t}\n\n\tif s.Name == \"\" {\n\t\treturn fmt.Errorf(\"Consul Linked Service requires Name\")\n\t}\n\n\tcaSet := s.CAFile != \"\"\n\tcertSet := s.CertFile != \"\"\n\tkeySet := s.KeyFile != \"\"\n\tsniSet := s.SNI != \"\"\n\n\tif (certSet || keySet) && !caSet {\n\t\treturn fmt.Errorf(\"Consul Linked Service TLS requires CAFile\")\n\t}\n\n\tif certSet != keySet {\n\t\treturn fmt.Errorf(\"Consul Linked Service TLS Cert and Key must both be set\")\n\t}\n\n\tif sniSet && !caSet {\n\t\treturn fmt.Errorf(\"Consul Linked Service TLS SNI requires CAFile\")\n\t}\n\n\treturn nil\n}\n\nfunc linkedServicesEqual(a, b []*ConsulLinkedService) bool {\n\treturn helper.ElementsEqual(a, b)\n}\n\ntype ConsulTerminatingConfigEntry struct {","sourceCodeStart":2624,"sourceCodeEnd":2660,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/services.go#L2624-L2660","documentation":"ConsulLinkedService.Validate: cert_file or key_file was set on a linked service without ca_file. Mutual TLS for linked services requires the CA that validates the peer certificate, so CAFile must accompany cert/key.","triggerScenarios":"Thrown at nomad/structs/services.go:2642 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Add ca_file to the linked service TLS config","Remove cert_file/key_file if TLS is not needed"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}