hashicorp/nomad · error

country value not provided

Error message

country value not provided

What it means

Returned by GenerateCA when the certificate options are custom (IsCustom) but the Country field is empty. Custom CA subjects require a full distinguished name, so a missing country aborts certificate generation.

Source

Thrown at helper/tlsutil/generate.go:145

		var err error
		sn, err = GenerateSerialNumber()
		if err != nil {
			return "", "", err
		}
	}

	if opts.Days == 0 {
		opts.Days = 1825
	}

	if opts.IsCustom() {
		if opts.Name == "" {
			return "", "", errors.New("common name value not provided")
		} else {
			opts.Name = fmt.Sprintf("%s %d", opts.Name, sn)
		}
		if opts.Country == "" {
			return "", "", errors.New("country value not provided")
		}

		if opts.Organization == "" {
			return "", "", errors.New("organization value not provided")
		}

		if opts.OrganizationalUnit == "" {
			return "", "", errors.New("organizational unit value not provided")
		}
	} else {
		opts.Name = fmt.Sprintf("Nomad Agent CA %d", sn)
		opts.Country = "US"
		opts.PostalCode = "94105"
		opts.Province = "CA"
		opts.Locality = "San Francisco"
		opts.StreetAddress = "101 Second Street"
		opts.Organization = "HashiCorp Inc."
		opts.OrganizationalUnit = "Nomad"

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set opts.Country (two-letter country code) when using custom CA options
2. Or omit custom options so GenerateCA fills defaults (e.g. US)

Example fix

// before
opts := &tlsutil.CAConfig{Name: "Nomad CA"} // Country missing
// after
opts := &tlsutil.CAConfig{Name: "Nomad CA", Country: "US"}

if opts.IsCustom() && opts.Country == "" {
    return errors.New("custom CA requires a Country")
}
ca, key, err := tlsutil.GenerateCA(opts)

func hasCountry(opts *tlsutil.CAConfig) bool { return opts.Country != "" }

ca, key, err := tlsutil.GenerateCA(opts)
if err != nil {
    if strings.Contains(err.Error(), "country value not provided") {
        return fmt.Errorf("set 'country' in custom TLS config: %w", err)
    }
    return err
}

When it happens

Trigger: tlsutil.GenerateCA with a CAConfig that has IsCustom() true (e.g. Name set) but Country empty — checked immediately after the Name check at generate.go:140.

Common situations: `nomad tls ca` invocations with custom name but no --country flag; TLS automation templates that fill Name but skip Country.

Related errors

• common name value not provided
• organization value not provided
• organizational unit value not provided
• certificate has expired or is not yet valid
• failed to parse CA file: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/8b139f02d9e83784. Report an issue: GitHub.