hashicorp/nomad · error

failed to copy certificate secrets/%s: %w

Error message

failed to copy certificate secrets/%s: %w

What it means

Returned by copyCertificate when io.Copy fails while copying a Consul TLS certificate file into the allocation's secrets directory. The source was opened and destination created, but the byte transfer itself failed.

Source

Thrown at client/allocrunner/taskrunner/connect_native_hook.go:165

	if source == "" {
		return nil
	}

	original, err := os.Open(source)
	if err != nil {
		return fmt.Errorf("failed to open consul TLS certificate: %w", err)
	}
	defer original.Close()

	destination := filepath.Join(dir, name)
	fd, err := os.Create(destination)
	if err != nil {
		return fmt.Errorf("failed to create secrets/%s: %w", name, err)
	}
	defer fd.Close()

	if _, err := io.Copy(fd, original); err != nil {
		return fmt.Errorf("failed to copy certificate secrets/%s: %w", name, err)
	}

	if err := fd.Sync(); err != nil {
		return fmt.Errorf("failed to write secrets/%s: %w", name, err)
	}

	return nil
}

// tlsEnv creates a set of additional of environment variables to be used when launching
// the connect native task. This will enable the task to communicate with Consul
// if Consul has transport security turned on.
//
// We do NOT set CONSUL_HTTP_TOKEN from the nomad agent's consul config, as that
// is a separate security concern addressed by the service identity hook.
func (h *connectNativeHook) tlsEnv(env map[string]string) map[string]string {
	m := make(map[string]string)

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Check client disk health and free space
2. Re-open/verify the source certificate file is readable
3. Restart the allocation to retry the copy

When it happens

Trigger: Thrown at client/allocrunner/taskrunner/connect_native_hook.go:165 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/26b5d20bdf19a56e. Report an issue: GitHub.