hashicorp/nomad · error

request certificate is only valid for %s: %v

Error message

request certificate is only valid for %s: %v

What it means

During raft TLS validation, handleConn/validateRaftTLS requires the peer's certificate to be valid for server.<region>.nomad. When ValidateCertificateForName fails and a certificate is present, the name-mismatch error is wrapped with this message listing the DNS names the certificate IS valid for, to ease diagnosing cert/region mismatches.

Source

Thrown at nomad/rpc.go:922

		}
	}
	return err
}

func (r *rpcHandler) validateRaftTLS(rpcCtx *RPCContext) error {
	// TLS is not configured or not to be enforced
	tlsConf := r.srv.config.TLSConfig
	if !tlsConf.EnableRPC || !tlsConf.VerifyServerHostname || tlsConf.RPCUpgradeMode {
		return nil
	}

	// check that `server.<region>.nomad` is present in cert
	expected := "server." + r.srv.Region() + ".nomad"
	err := rpcCtx.ValidateCertificateForName(expected)
	if err != nil {
		cert := rpcCtx.Certificate()
		if cert != nil {
			err = fmt.Errorf("request certificate is only valid for %s: %v", cert.DNSNames, err)
		}

		return fmt.Errorf("unauthorized raft connection from %s: %v", rpcCtx.Conn.RemoteAddr(), err)
	}

	// Certificate is valid for the expected name
	return nil
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Re-issue the peer's certificate including DNS SAN server.<region>.nomad for the local region
2. Verify region config matches certificate names on both servers (`openssl x509 -text`)
3. Use a CA template that generates region-scoped SANs for server certs
4. Replace any client-role certificates being used on server RPC ports

Example fix

// before
subjectAltName=DNS:server.us-west-1.nomad   # used in us-east-1 region
// after
subjectAltName=DNS:server.us-east-1.nomad   # matches server region config

cert, _ := tls.LoadX509Certificate("server.pem")
expected := "server." + region + ".nomad"
if !slices.Contains(append([]string{cert.Subject.CommonName}, cert.DNSNames...), expected) {
    return fmt.Errorf("cert must include SAN %s", expected)
}

func validForRaftTLS(cert *x509.Certificate, region string) bool {
    return certCoversName(cert, "server."+region+".nomad")
}

if err != nil && strings.Contains(err.Error(), "request certificate is only valid for") {
    return fmt.Errorf("re-issue server cert with SAN server.<region>.nomad: %w", err)
}

When it happens

Trigger: A server-to-server connection whose certificate's SANs/CN do not include server.<local-region>.nomad — certs issued for a different region, client-role certs used for server connections, or misconfigured region names.

Common situations: Adding a new region without re-issuing certs; copying certs from another region; region renamed in config but certificates still use the old name; CA automation templates lacking the right SAN.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• invalid certificate, %s not in %s
• unauthorized raft connection from %s: %v
• failed to parse cert key pair: %w
• failed to parse cert bytes: %w
• invalid certificate: %s not in expected %s

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/1b2cfeb48468c4e1. Report an issue: GitHub.