hashicorp/nomad · error

Consul Linked Service TLS Cert and Key must both be set

Error message

Consul Linked Service TLS Cert and Key must both be set

What it means

ConsulLinkedService.Validate: exactly one of cert_file/key_file was set on a linked service. Client certificates must be supplied as a pair, so setting only one is rejected.

Source

Thrown at nomad/structs/services.go:2646

	if s == nil {
		return nil
	}

	if s.Name == "" {
		return fmt.Errorf("Consul Linked Service requires Name")
	}

	caSet := s.CAFile != ""
	certSet := s.CertFile != ""
	keySet := s.KeyFile != ""
	sniSet := s.SNI != ""

	if (certSet || keySet) && !caSet {
		return fmt.Errorf("Consul Linked Service TLS requires CAFile")
	}

	if certSet != keySet {
		return fmt.Errorf("Consul Linked Service TLS Cert and Key must both be set")
	}

	if sniSet && !caSet {
		return fmt.Errorf("Consul Linked Service TLS SNI requires CAFile")
	}

	return nil
}

func linkedServicesEqual(a, b []*ConsulLinkedService) bool {
	return helper.ElementsEqual(a, b)
}

type ConsulTerminatingConfigEntry struct {
	Services []*ConsulLinkedService
}

func (e *ConsulTerminatingConfigEntry) Copy() *ConsulTerminatingConfigEntry {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set both cert_file and key_file
2. Remove both if no client certificate is needed

When it happens

Trigger: Thrown at nomad/structs/services.go:2646 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/c4277deb1b16acb9. Report an issue: GitHub.