hashicorp/nomad · error

Consul Linked Service TLS SNI requires CAFile

Error message

Consul Linked Service TLS SNI requires CAFile

What it means

ConsulLinkedService.Validate: sni was set on a linked service without ca_file. SNI only makes sense when TLS with a CA is configured, so it is rejected when CAFile is absent.

Source

Thrown at nomad/structs/services.go:2650

	if s.Name == "" {
		return fmt.Errorf("Consul Linked Service requires Name")
	}

	caSet := s.CAFile != ""
	certSet := s.CertFile != ""
	keySet := s.KeyFile != ""
	sniSet := s.SNI != ""

	if (certSet || keySet) && !caSet {
		return fmt.Errorf("Consul Linked Service TLS requires CAFile")
	}

	if certSet != keySet {
		return fmt.Errorf("Consul Linked Service TLS Cert and Key must both be set")
	}

	if sniSet && !caSet {
		return fmt.Errorf("Consul Linked Service TLS SNI requires CAFile")
	}

	return nil
}

func linkedServicesEqual(a, b []*ConsulLinkedService) bool {
	return helper.ElementsEqual(a, b)
}

type ConsulTerminatingConfigEntry struct {
	Services []*ConsulLinkedService
}

func (e *ConsulTerminatingConfigEntry) Copy() *ConsulTerminatingConfigEntry {
	if e == nil {
		return nil
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Add ca_file alongside sni
2. Remove sni if not using TLS

When it happens

Trigger: Thrown at nomad/structs/services.go:2650 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/52a38ee0768a8608. Report an issue: GitHub.