thanos-io/thanos · error

tls client cert field requested is not supported

Error message

tls client cert field requested is not supported

What it means

Thrown by getTenantFromCertificate when the configured tenant certificate field does not match any supported case (organization, organizationalUnit, commonName). This indicates an invalid value for the tenancy configuration rather than a problem with the certificate itself.

Solutions

1. Set --tenant-certificate-field to one of the supported values: organization, organizationalUnit, or common-name
2. Check 'thanos <subcmd> --help' for the exact accepted values in your version
3. Validate the flag value at startup; rely on the flag's built-in enum parsing if available
4. Align config templates with the Thanos version in use after upgrades

Example fix

// before
--tenant-certificate-field=Org
// after
--tenant-certificate-field=organization

// Validate the flag before starting the server
allowed := map[string]bool{"organization": true, "organizationalUnit": true, "commonName": true}
if !allowed[tlsCertField] {
    log.Fatalf("unsupported --tenant-certificate-field %q", tlsCertField)
}

func isSupportedCertField(f string) bool {
    switch f {
    case "organization", "organizationalUnit", "commonName":
        return true
    }
    return false
}

When it happens

Trigger: GetTenantFromHTTP invoked with a certTenantField value outside the CertificateField constants, e.g. an unparsed or misspelled --tenant-certificate-field flag value reaching this switch's default branch.

Common situations: Typo in the tenant-certificate-field flag value; a new/older Thanos version adding or renaming field constants; config generated programmatically with an unvalidated string.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• building gRPC client
• setup gRPC server
• could not get organization field from client cert
• could not get organizationalUnit field from client cert
• could not get commonName field from client cert

AI-assisted analysis of thanos-io/thanos@35b8b99117 (2026-09-07). Data as JSON: /api/errors/d656fec415d19ed6. Report an issue: GitHub.

Appendix: source

Thrown at pkg/tenancy/tenancy.go:129

		if len(cert.Subject.Organization) == 0 {
			return "", errors.New("could not get organization field from client cert")
		}
		tenant = cert.Subject.Organization[0]

	case CertificateFieldOrganizationalUnit:
		if len(cert.Subject.OrganizationalUnit) == 0 {
			return "", errors.New("could not get organizationalUnit field from client cert")
		}
		tenant = cert.Subject.OrganizationalUnit[0]

	case CertificateFieldCommonName:
		if cert.Subject.CommonName == "" {
			return "", errors.New("could not get commonName field from client cert")
		}
		tenant = cert.Subject.CommonName

	default:
		return "", errors.New("tls client cert field requested is not supported")
	}

	return tenant, nil
}

func GetTenantFromGRPCMetadata(ctx context.Context) (string, bool) {
	md, ok := metadata.FromIncomingContext(ctx)
	if !ok || len(md.Get(DefaultTenantHeader)) == 0 {
		return DefaultTenant, false
	}
	return md.Get(DefaultTenantHeader)[0], true
}

func EnforceQueryTenancy(tenantLabel string, tenant string, query string) (string, error) {
	labelMatcher := &labels.Matcher{
		Name:  tenantLabel,
		Type:  labels.MatchEqual,
		Value: tenant,

View on GitHub (pinned to 35b8b99117)