hashicorp/nomad · error

Both client cert and client key must be provided

Error message

Both client cert and client key must be provided

What it means

Returned by ConfigureTLS when the TLS config supplies only one of ClientCert or ClientKey file paths. Mutual-TLS client authentication requires the certificate and its private key to be loaded as a pair via tls.LoadX509KeyPair, so a half-configured pair is rejected before any connection is made.

Source

Thrown at api/api.go:465

	if tlsConfig == nil {
		return nil
	}
	if httpClient == nil {
		return errors.New("config HTTP Client must be set")
	}

	var clientCert tls.Certificate
	foundClientCert := false
	if tlsConfig.ClientCert != "" || tlsConfig.ClientKey != "" {
		if tlsConfig.ClientCert != "" && tlsConfig.ClientKey != "" {
			var err error
			clientCert, err = tls.LoadX509KeyPair(tlsConfig.ClientCert, tlsConfig.ClientKey)
			if err != nil {
				return err
			}
			foundClientCert = true
		} else {
			return errors.New("Both client cert and client key must be provided")
		}
	} else if len(tlsConfig.ClientCertPEM) != 0 || len(tlsConfig.ClientKeyPEM) != 0 {
		if len(tlsConfig.ClientCertPEM) != 0 && len(tlsConfig.ClientKeyPEM) != 0 {
			var err error
			clientCert, err = tls.X509KeyPair(tlsConfig.ClientCertPEM, tlsConfig.ClientKeyPEM)
			if err != nil {
				return err
			}
			foundClientCert = true
		} else {
			return errors.New("Both client cert and client key must be provided")
		}
	}

	clientTLSConfig := httpClient.Transport.(*http.Transport).TLSClientConfig
	rootConfig := &rootcerts.Config{
		CAFile:        tlsConfig.CACert,
		CAPath:        tlsConfig.CAPath,

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set both TLSConfig.ClientCert and TLSConfig.ClientKey to the PEM cert and key file paths
2. Alternatively use ClientCertPEM/ClientKeyPEM in-memory fields, both together

When it happens

Trigger: Thrown at api/api.go:465 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/5d40265bc742c281. Report an issue: GitHub.