hashicorp/nomad · error

Consul Linked Service TLS requires CAFile

Error message

Consul Linked Service TLS requires CAFile

What it means

ConsulLinkedService.Validate: cert_file or key_file was set on a linked service without ca_file. Mutual TLS for linked services requires the CA that validates the peer certificate, so CAFile must accompany cert/key.

Source

Thrown at nomad/structs/services.go:2642

	return true
}

func (s *ConsulLinkedService) Validate() error {
	if s == nil {
		return nil
	}

	if s.Name == "" {
		return fmt.Errorf("Consul Linked Service requires Name")
	}

	caSet := s.CAFile != ""
	certSet := s.CertFile != ""
	keySet := s.KeyFile != ""
	sniSet := s.SNI != ""

	if (certSet || keySet) && !caSet {
		return fmt.Errorf("Consul Linked Service TLS requires CAFile")
	}

	if certSet != keySet {
		return fmt.Errorf("Consul Linked Service TLS Cert and Key must both be set")
	}

	if sniSet && !caSet {
		return fmt.Errorf("Consul Linked Service TLS SNI requires CAFile")
	}

	return nil
}

func linkedServicesEqual(a, b []*ConsulLinkedService) bool {
	return helper.ElementsEqual(a, b)
}

type ConsulTerminatingConfigEntry struct {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Add ca_file to the linked service TLS config
2. Remove cert_file/key_file if TLS is not needed

When it happens

Trigger: Thrown at nomad/structs/services.go:2642 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/f9d4eab64bc3c104. Report an issue: GitHub.