hashicorp/nomad · error

VerifyIncoming set, and no Cert/Key pair provided!

Error message

VerifyIncoming set, and no Cert/Key pair provided!

What it means

IncomingTLSConfig requires the server itself to present a certificate when VerifyIncoming is set; if no certificate was successfully loaded (cert == nil), the config is rejected. A server enforcing client verification must also authenticate itself to clients.

Source

Thrown at helper/tlsutil/config.go:372

		return nil, err
	}

	// Add cert/key
	cert, err := c.LoadKeyPair()
	if err != nil {
		return nil, err
	} else if cert != nil {
		tlsConfig.GetCertificate = c.KeyLoader.GetOutgoingCertificate
	}

	// Check if we require verification
	if c.VerifyIncoming {
		tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
		if c.CAFile == "" {
			return nil, fmt.Errorf("VerifyIncoming set, and no CA certificate provided!")
		}
		if cert == nil {
			return nil, fmt.Errorf("VerifyIncoming set, and no Cert/Key pair provided!")
		}
	}

	return tlsConfig, nil
}

// ParseCiphers parses ciphersuites from the comma-separated string into
// recognized slice
func ParseCiphers(tlsConfig *config.TLSConfig) ([]uint16, error) {
	suites := []uint16{}

	cipherStr := strings.TrimSpace(tlsConfig.TLSCipherSuites)

	var parsedCiphers []string
	if cipherStr == "" {
		parsedCiphers = defaultTLSCiphers

	} else {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set cert_file and key_file in the tls stanza to a valid PEM cert/key pair.
2. Check that both files exist, are readable, and the key matches the certificate.
3. If client verification isn't intended, remove verify_incoming = true.

Example fix

// before
cfg := &tlsutil.Config{ VerifyIncoming: true, CAFile: "ca.pem" }
// after
cfg := &tlsutil.Config{ VerifyIncoming: true, CAFile: "ca.pem", CertFile: "server.pem", KeyFile: "server-key.pem" }

if cfg.VerifyIncoming && (cfg.CertFile == "" || cfg.KeyFile == "") {
    return errors.New("verify_incoming requires cert_file and key_file")
}
if _, err := tls.LoadX509KeyPair(cfg.CertFile, cfg.KeyFile); err != nil {
    return err
}

When it happens

Trigger: Calling IncomingTLSConfig with VerifyIncoming=true but with CertFile/KeyFile empty, or with a cert that failed to load earlier (e.g. LoadKeyPair errored silently leaving cert nil).

Common situations: Setting verify_incoming = true but forgetting cert_file/key_file; typo'd cert paths causing the pair not to load; configs migrated from HTTP-only setups.

Related errors

• invalid certificate: %s not in expected %s
• no PEM-encoded data found
• missing certificate information
• failed to parse cert key pair: %w
• failed to parse cert bytes: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/af1a07ac276eae7f. Report an issue: GitHub.