hashicorp/nomad · error

organizational unit value not provided

Error message

organizational unit value not provided

What it means

Fires in GenerateCA for a custom CA (IsCustom) whose OrganizationalUnit is empty; the custom subject requires all fields (name, country, organization, OU) to be set before generation proceeds.

Source

Thrown at helper/tlsutil/generate.go:153

		opts.Days = 1825
	}

	if opts.IsCustom() {
		if opts.Name == "" {
			return "", "", errors.New("common name value not provided")
		} else {
			opts.Name = fmt.Sprintf("%s %d", opts.Name, sn)
		}
		if opts.Country == "" {
			return "", "", errors.New("country value not provided")
		}

		if opts.Organization == "" {
			return "", "", errors.New("organization value not provided")
		}

		if opts.OrganizationalUnit == "" {
			return "", "", errors.New("organizational unit value not provided")
		}
	} else {
		opts.Name = fmt.Sprintf("Nomad Agent CA %d", sn)
		opts.Country = "US"
		opts.PostalCode = "94105"
		opts.Province = "CA"
		opts.Locality = "San Francisco"
		opts.StreetAddress = "101 Second Street"
		opts.Organization = "HashiCorp Inc."
		opts.OrganizationalUnit = "Nomad"
	}

	// Create the CA cert
	template := x509.Certificate{
		SerialNumber: sn,
		Subject: pkix.Name{
			Country:            []string{opts.Country},
			PostalCode:         []string{opts.PostalCode},

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set opts.OrganizationalUnit when using custom CA options
2. Or use default (non-custom) CA generation

Example fix

// before
opts := &tlsutil.CAConfig{Name: "Nomad CA", Country: "US", Organization: "HashiCorp"} // OU missing
// after
opts := &tlsutil.CAConfig{Name: "Nomad CA", Country: "US", Organization: "HashiCorp", OrganizationalUnit: "Engineering"}

if opts.IsCustom() && opts.OrganizationalUnit == "" {
    return errors.New("custom CA requires an OrganizationalUnit")
}
ca, key, err := tlsutil.GenerateCA(opts)

func hasOrganizationalUnit(opts *tlsutil.CAConfig) bool { return opts.OrganizationalUnit != "" }

ca, key, err := tlsutil.GenerateCA(opts)
if err != nil {
    if strings.Contains(err.Error(), "organizational unit value not provided") {
        return fmt.Errorf("set 'organizational_unit' in custom TLS config: %w", err)
    }
    return err
}

When it happens

Trigger: tlsutil.GenerateCA with IsCustom() true and opts.OrganizationalUnit empty — checked after Name, Country, and Organization.

Common situations: Scripts that populate name/country/organization but omit the OU (e.g. --organizational-unit); config structs copied from examples that skip OU.

Related errors

• common name value not provided
• country value not provided
• organization value not provided
• certificate has expired or is not yet valid
• failed to parse CA file: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/4a43859e99450deb. Report an issue: GitHub.