What causes "organization value not provided" in hashicorp/nomad?

Set opts.Organization before generating the CA

organization value not provided

Error message

organization value not provided

What it means

Fires in GenerateCA when the CA options are custom (IsCustom) but opts.Organization is empty; a custom certificate requires an Organization field in the subject, so the CA is not generated.

Source

Thrown at helper/tlsutil/generate.go:149

		}
	}

	if opts.Days == 0 {
		opts.Days = 1825
	}

	if opts.IsCustom() {
		if opts.Name == "" {
			return "", "", errors.New("common name value not provided")
		} else {
			opts.Name = fmt.Sprintf("%s %d", opts.Name, sn)
		}
		if opts.Country == "" {
			return "", "", errors.New("country value not provided")
		}

		if opts.Organization == "" {
			return "", "", errors.New("organization value not provided")
		}

		if opts.OrganizationalUnit == "" {
			return "", "", errors.New("organizational unit value not provided")
		}
	} else {
		opts.Name = fmt.Sprintf("Nomad Agent CA %d", sn)
		opts.Country = "US"
		opts.PostalCode = "94105"
		opts.Province = "CA"
		opts.Locality = "San Francisco"
		opts.StreetAddress = "101 Second Street"
		opts.Organization = "HashiCorp Inc."
		opts.OrganizationalUnit = "Nomad"
	}

	// Create the CA cert
	template := x509.Certificate{

View on GitHub (pinned to 482b49bf1a)

Solutions

Set opts.Organization before generating the CA
Or drop the custom options to use generated defaults

Example fix

// before
opts := &tlsutil.CAConfig{Name: "Nomad CA", Country: "US"} // Organization missing
// after
opts := &tlsutil.CAConfig{Name: "Nomad CA", Country: "US", Organization: "HashiCorp"}

Defensive patterns

Strategy: validation

Validate before calling

if opts.IsCustom() && opts.Organization == "" {
    return errors.New("custom CA requires an Organization")
}
ca, key, err := tlsutil.GenerateCA(opts)

Type guard

func hasOrganization(opts *tlsutil.CAConfig) bool { return opts.Organization != "" }

Try / catch

ca, key, err := tlsutil.GenerateCA(opts)
if err != nil {
    if strings.Contains(err.Error(), "organization value not provided") {
        return fmt.Errorf("set 'organization' in custom TLS config: %w", err)
    }
    return err
}

Prevention

Include organization in every custom CA subject.
Group subject fields in one config object so they are set/omitted together.
Surface all missing fields to users at once rather than one error per field.

When it happens

Trigger: tlsutil.GenerateCA with IsCustom() true and Organization empty — checked after Name and Country.

Common situations: Custom CA configs built programmatically where only Name/Country were populated; CLI usage specifying name/country but not --organization.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/d9dfc87f87f57b35. Report an issue: GitHub.