hashicorp/nomad · error

failed to open consul TLS certificate: %w

Error message

failed to open consul TLS certificate: %w

What it means

connectNativeHook.copyCertificate failed to os.Open the Consul TLS cert file configured in the client's Consul block (file missing or unreadable) while copying TLS material into the task's secrets dir for Connect Native tasks.

Source

Thrown at client/allocrunner/taskrunner/connect_native_hook.go:153

		return err
	}
	if err := h.copyCertificate(consulConfig.CertFile, dir, secretCertfileFilename); err != nil {
		return err
	}
	if err := h.copyCertificate(consulConfig.KeyFile, dir, secretKeyfileFilename); err != nil {
		return err
	}
	return nil
}

func (connectNativeHook) copyCertificate(source, dir, name string) error {
	if source == "" {
		return nil
	}

	original, err := os.Open(source)
	if err != nil {
		return fmt.Errorf("failed to open consul TLS certificate: %w", err)
	}
	defer original.Close()

	destination := filepath.Join(dir, name)
	fd, err := os.Create(destination)
	if err != nil {
		return fmt.Errorf("failed to create secrets/%s: %w", name, err)
	}
	defer fd.Close()

	if _, err := io.Copy(fd, original); err != nil {
		return fmt.Errorf("failed to copy certificate secrets/%s: %w", name, err)
	}

	if err := fd.Sync(); err != nil {
		return fmt.Errorf("failed to write secrets/%s: %w", name, err)
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Verify cert_file/key_file/ca_file paths in the client's consul config exist
2. Check file read permissions for the Nomad client user
3. Fix or remove the TLS config if Consul uses no client certs

When it happens

Trigger: Thrown at client/allocrunner/taskrunner/connect_native_hook.go:153 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/2816aa3dcf8388f3. Report an issue: GitHub.