hashicorp/nomad · error

unauthorized raft connection from %s: %v

Error message

unauthorized raft connection from %s: %v

What it means

validateRaftTLS rejects incoming raft connections whose certificate is not valid for the expected server.<region>.nomad name, wrapping any prior error (including the name-mismatch detail) into this unauthorized-connection error. It is a security gate: the server refuses raft RPCs from peers it cannot cryptographically verify as servers for this region.

Source

Thrown at nomad/rpc.go:925

}

func (r *rpcHandler) validateRaftTLS(rpcCtx *RPCContext) error {
	// TLS is not configured or not to be enforced
	tlsConf := r.srv.config.TLSConfig
	if !tlsConf.EnableRPC || !tlsConf.VerifyServerHostname || tlsConf.RPCUpgradeMode {
		return nil
	}

	// check that `server.<region>.nomad` is present in cert
	expected := "server." + r.srv.Region() + ".nomad"
	err := rpcCtx.ValidateCertificateForName(expected)
	if err != nil {
		cert := rpcCtx.Certificate()
		if cert != nil {
			err = fmt.Errorf("request certificate is only valid for %s: %v", cert.DNSNames, err)
		}

		return fmt.Errorf("unauthorized raft connection from %s: %v", rpcCtx.Conn.RemoteAddr(), err)
	}

	// Certificate is valid for the expected name
	return nil
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Re-issue server certificates with server.<region>.nomad in CN or DNS SANs and a chain trusted by both peers
2. Confirm both servers share the same CA and region configuration
3. Check server logs for the wrapped 'request certificate is only valid for' detail to see the cert's actual names
4. Fix region name mismatches between nomad config and certificate names

Example fix

// before
region = "us-east-2"  # cert is for server.us-east-1.nomad
// after
region = "us-east-1"  # matches certificate, or re-issue cert for us-east-2

cert, _ := tls.LoadX509Certificate("server.pem")
if cert == nil || !slices.Contains(cert.DNSNames, "server."+region+".nomad") {
    return fmt.Errorf("server cert not authorized for region %s", region)
}

func isRaftAuthzError(err error) bool {
    return err != nil && strings.Contains(err.Error(), "unauthorized raft connection")
}

if err := connectRaft(peer); err != nil && isRaftAuthzError(err) {
    return fmt.Errorf("peer cert rejected; verify CA trust and server.<region>.nomad SAN: %w", err)
}

When it happens

Trigger: Any raft/TLS connection to a Nomad server where the presented certificate fails ValidateCertificateForName for server.<region>.nomad — wrong-region cert, expired or untrusted cert chain, or non-server certificate.

Common situations: Cert rotation mistakes (new certs missing region SANs); mixing clusters with different CAs; clients accidentally connecting to server RPC ports; region config typos making expected name differ from cert names.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• invalid certificate, %s not in %s
• request certificate is only valid for %s: %v
• running container as ContainerAdmin is unsafe; change the co
• failed to reset heartbeat since server is not leader
• unsupported minimum common raft protocol version

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/4f6eb717dccfdcfd. Report an issue: GitHub.