hashicorp/nomad · error

VerifyOutgoing set, and no CA certificate provided!

Error message

VerifyOutgoing set, and no CA certificate provided!

What it means

OutgoingTLSConfig builds the tls.Config used for outbound connections. When VerifyOutgoing is enabled, Nomad will verify server certificates against a CA, so a CA file must be configured; otherwise verification is impossible and the agent refuses to build the TLS config. This is a startup/config-validation error, not a runtime network failure.

Source

Thrown at helper/tlsutil/config.go:239

		c.VerifyOutgoing = true
	}
	if !c.VerifyOutgoing {
		return nil, nil
	}
	// Create the tlsConfig
	tlsConfig := &tls.Config{
		RootCAs:            x509.NewCertPool(),
		InsecureSkipVerify: true,
		CipherSuites:       c.CipherSuites,
		MinVersion:         c.MinVersion,
	}
	if c.VerifyServerHostname {
		tlsConfig.InsecureSkipVerify = false
	}

	// Ensure we have a CA if VerifyOutgoing is set
	if c.VerifyOutgoing && c.CAFile == "" {
		return nil, fmt.Errorf("VerifyOutgoing set, and no CA certificate provided!")
	}

	// Parse the CA cert if any
	err := c.AppendCA(tlsConfig.RootCAs)
	if err != nil {
		return nil, err
	}

	cert, err := c.LoadKeyPair()
	if err != nil {
		return nil, err
	} else if cert != nil {
		tlsConfig.GetCertificate = c.KeyLoader.GetOutgoingCertificate
		tlsConfig.GetClientCertificate = c.KeyLoader.GetClientCertificate
	}

	return tlsConfig, nil
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set ca_file in the agent tls stanza (or TLSConfig.CAFile) to the PEM-encoded CA certificate path.
2. If mTLS verification is not needed yet, remove verify_outgoing = true (not recommended for production).
3. Ensure the CA file exists and is readable by the Nomad process before starting the agent.

Example fix

// before
tlsConfig := &tlsutil.Config{ VerifyOutgoing: true }
// after
tlsConfig := &tlsutil.Config{ VerifyOutgoing: true, CAFile: "/etc/nomad.d/tls/ca.pem" }

if cfg.VerifyOutgoing && cfg.CAFile == "" {
    return errors.New("verify_outgoing requires ca_file to be set")
}

When it happens

Trigger: Calling OutgoingTLSConfig (or OutgoingTLSWrapper) with a TLSConfig where VerifyOutgoing=true and CAFile=="" (i.e. verify_outgoing enabled in the agent config but no ca_file path set).

Common situations: Operators set verify_outgoing = true in the Nomad agent 'tls' stanza but forget to set ca_file; provisioning templates that enable verification without distributing the CA cert; moving from insecure to TLS setups mid-cluster.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to initialize Consul client config: %v
• cannot reload agent with nil configuration
• https_handshake_timeout must be >= 0
• failed to initialize HTTP server TLS configuration: %s
• failed to configure TLS: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/99d8a23f358bcdda. Report an issue: GitHub.