hashicorp/nomad · error

could not read -jwks-certfile: %v

Error message

could not read -jwks-certfile: %v

What it means

When -jwks-certfile is provided, renderAuthMethod reads the CA cert file to embed as jwks_ca_pem in the auth config. If os.ReadFile fails (missing file, no permissions, path is a directory), this error is returned.

Source

Thrown at command/setup_vault.go:513

func (s *SetupVaultCommand) authMethodExists() bool {
	existingConf, _ := s.vLogical.Read(fmt.Sprintf("/auth/%s/config", vaultPath))
	return existingConf != nil
}

func (s *SetupVaultCommand) renderAuthMethod() (map[string]any, error) {
	authConfig := map[string]any{}
	err := json.Unmarshal(vaultAuthConfigBody, &authConfig)
	if err != nil {
		return nil, fmt.Errorf("default auth config text could not be deserialized: %v", err)
	}

	authConfig["jwks_url"] = s.jwksURL
	authConfig["default_role"] = vaultRole

	if s.jwksCACertPath != "" {
		caCert, err := os.ReadFile(s.jwksCACertPath)
		if err != nil {
			return nil, fmt.Errorf("could not read -jwks-certfile: %v", err)
		}
		authConfig["jwks_ca_pem"] = string(caCert)
	}

	return authConfig, nil
}

func (s *SetupVaultCommand) createAuthMethod(authConfig map[string]any) error {
	err := s.vClient.Sys().EnableAuthWithOptions(vaultPath, &api.MountInput{Type: "jwt"})
	if err != nil {
		return fmt.Errorf("[✘] Could not enable JWT credential backend: %w", err)
	}

	buf, err := json.Marshal(authConfig)
	if err != nil {
		return fmt.Errorf("auth method could not be interpolated with args: %w", err)
	}
	_, err = s.vLogical.WriteBytes(fmt.Sprintf("auth/%s/config", vaultPath), buf)

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Verify the file path passed to -jwks-certfile exists and is readable by the current user
2. Pass the CA certificate (or bundle) that signed the JWKS endpoint, not the leaf cert
3. In containers, mount the cert file into the pod/container
4. Use an absolute path rather than a relative one

Example fix

// before
nomad setup -jwks-certfile=./jwks-ca.pem
// after
nomad setup -jwks-certfile=$(pwd)/jwks-ca.pem  # path verified with ls -l first

if s.jwksCACertPath != "" {
    if fi, err := os.Stat(s.jwksCACertPath); err != nil || fi.IsDir() {
        return nil, fmt.Errorf("-jwks-certfile not a readable file: %s", s.jwksCACertPath)
    }
}

if _, err := os.ReadFile(path); err != nil && os.IsNotExist(err) { /* fix path before rerun */ }

When it happens

Trigger: os.ReadFile(s.jwksCACertPath) errors: file does not exist, insufficient read permission, or path points to a directory.

Common situations: Typo in the -jwks-certfile path; passing the JWKS URL's leaf cert instead of the CA bundle; file generated after this step ran; running in a container without the cert mounted.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

• Failed to read CA file: %v
• error reading %s: %w
• unable to read rooted allocation directory
• plugin not found
• plugin not executable

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/6ea962f601703b4b. Report an issue: GitHub.