hashicorp/nomad · error

VerifyIncoming set, and no CA certificate provided!

Error message

VerifyIncoming set, and no CA certificate provided!

What it means

IncomingTLSConfig builds the tls.Config for inbound connections. With VerifyIncoming set, the server requires and verifies client certificates, which needs a CA to validate against; if CAFile is empty the config is rejected. The CA must be present before a client certificate check can succeed.

Source

Thrown at helper/tlsutil/config.go:369

	// Parse the CA cert if any
	err := c.AppendCA(tlsConfig.ClientCAs)
	if err != nil {
		return nil, err
	}

	// Add cert/key
	cert, err := c.LoadKeyPair()
	if err != nil {
		return nil, err
	} else if cert != nil {
		tlsConfig.GetCertificate = c.KeyLoader.GetOutgoingCertificate
	}

	// Check if we require verification
	if c.VerifyIncoming {
		tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
		if c.CAFile == "" {
			return nil, fmt.Errorf("VerifyIncoming set, and no CA certificate provided!")
		}
		if cert == nil {
			return nil, fmt.Errorf("VerifyIncoming set, and no Cert/Key pair provided!")
		}
	}

	return tlsConfig, nil
}

// ParseCiphers parses ciphersuites from the comma-separated string into
// recognized slice
func ParseCiphers(tlsConfig *config.TLSConfig) ([]uint16, error) {
	suites := []uint16{}

	cipherStr := strings.TrimSpace(tlsConfig.TLSCipherSuites)

	var parsedCiphers []string
	if cipherStr == "" {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set ca_file in the tls stanza to the CA bundle used to sign client certificates.
2. If you don't intend to verify client certs, disable verify_incoming.
3. Verify the CA file path resolves on the server node and contains the signing CA.

Example fix

// before
cfg := &tlsutil.Config{ VerifyIncoming: true, CertFile: "cert.pem", KeyFile: "key.pem" }
// after
cfg := &tlsutil.Config{ VerifyIncoming: true, CAFile: "ca.pem", CertFile: "cert.pem", KeyFile: "key.pem" }

if cfg.VerifyIncoming && cfg.CAFile == "" {
    return errors.New("verify_incoming requires ca_file to be set")
}

When it happens

Trigger: Calling IncomingTLSConfig (via startTLSServer / NewTLSConfiguration) with VerifyIncoming=true and CAFile=="".

Common situations: Setting verify_incoming = true in the tls stanza without ca_file; copying a config where the CA path was removed; Ansible/Helm charts enabling mTLS without mounting the CA secret.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• missing certificate information
• failed to initialize Consul client config: %v
• cannot reload agent with nil configuration
• https_handshake_timeout must be >= 0
• failed to initialize HTTP server TLS configuration: %s

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/d8bcef3a8d0e1189. Report an issue: GitHub.