hashicorp/nomad · error

common name value not provided

Error message

common name value not provided

What it means

GenerateCA creates a self-signed CA certificate. When opts.IsCustom() is true, the caller must supply all certificate subject fields; an empty opts.Name (the common name) causes this error instead of falling back to Nomad defaults.

Source

Thrown at helper/tlsutil/generate.go:140

	if err != nil {
		return "", "", err
	}

	if sn == nil {
		var err error
		sn, err = GenerateSerialNumber()
		if err != nil {
			return "", "", err
		}
	}

	if opts.Days == 0 {
		opts.Days = 1825
	}

	if opts.IsCustom() {
		if opts.Name == "" {
			return "", "", errors.New("common name value not provided")
		} else {
			opts.Name = fmt.Sprintf("%s %d", opts.Name, sn)
		}
		if opts.Country == "" {
			return "", "", errors.New("country value not provided")
		}

		if opts.Organization == "" {
			return "", "", errors.New("organization value not provided")
		}

		if opts.OrganizationalUnit == "" {
			return "", "", errors.New("organizational unit value not provided")
		}
	} else {
		opts.Name = fmt.Sprintf("Nomad Agent CA %d", sn)
		opts.Country = "US"
		opts.PostalCode = "94105"

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Provide opts.Name (common name), e.g. the cluster or CA name, when using custom CA options.
2. Or omit all custom fields so IsCustom() is false and Nomad generates default subject values.
3. Validate required custom fields (Name, Country, Organization, OrganizationalUnit) before calling GenerateCA.

Example fix

// before
ca, key, err := tlsutil.GenerateCA(&tlsutil.CAConfig{Country: "US"}) // error: no Name
// after
ca, key, err := tlsutil.GenerateCA(&tlsutil.CAConfig{Name: "Nomad CA", Country: "US"})

if opts.IsCustom() && opts.Name == "" {
    return errors.New("custom CA requires a Name (common name)")
}
ca, key, err := tlsutil.GenerateCA(opts)

func customCAComplete(opts *tlsutil.CAConfig) bool {
    return opts.IsCustom() && opts.Name != "" && opts.Country != "" &&
        opts.Organization != "" && opts.OrganizationalUnit != ""
}

ca, key, err := tlsutil.GenerateCA(opts)
if err != nil {
    if strings.Contains(err.Error(), "common name value not provided") {
        return fmt.Errorf("custom TLS config requires 'name': %w", err)
    }
    return err
}

When it happens

Trigger: Calling tlsutil.GenerateCA with CAConfig where IsCustom() is true (any of Name/Country/Organization/etc. set) but Name is left empty.

Common situations: Partially filled custom TLS config in `nomad tls ca` CLI or agent TLS setup — e.g. setting --country but forgetting --name; automated TLS provisioning scripts that pass a struct with only some fields.

Related errors

• country value not provided
• organization value not provided
• organizational unit value not provided
• certificate has expired or is not yet valid
• failed to parse CA file: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/cb92a6f307d03487. Report an issue: GitHub.