{"record":{"id":"0d318f623b1cbe37","repo":"nats-io/nats-server","slug":"error-parsing-pinned-certs-key-s-does-not-look","errorCode":null,"errorMessage":"error parsing 'pinned_certs' key %s does not look like lower case hex-encoded sha256 of DER encoded SubjectPublicKeyInfo","messagePattern":"error parsing 'pinned_certs' key (.+?) does not look like lower case hex-encoded sha256 of DER encoded SubjectPublicKeyInfo","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/server.go","lineNumber":1160,"sourceCode":"\t\t\treturn fmt.Errorf(\"pool_size cannot be negative if pinned accounts are specified\")\n\t\t}\n\t\tm := make(map[string]struct{}, l)\n\t\tfor _, a := range o.Cluster.PinnedAccounts {\n\t\t\tif _, exists := m[a]; exists {\n\t\t\t\treturn fmt.Errorf(\"found duplicate account name %q in pinned accounts list %q\", a, o.Cluster.PinnedAccounts)\n\t\t\t}\n\t\t\tm[a] = struct{}{}\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc validatePinnedCerts(pinned PinnedCertSet) error {\n\tre := regexp.MustCompile(\"^[a-f0-9]{64}$\")\n\tfor certId := range pinned {\n\t\tentry := strings.ToLower(certId)\n\t\tif !re.MatchString(entry) {\n\t\t\treturn fmt.Errorf(\"error parsing 'pinned_certs' key %s does not look like lower case hex-encoded sha256 of DER encoded SubjectPublicKeyInfo\", entry)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc validateOptions(o *Options) error {\n\tif o.LameDuckDuration > 0 && o.LameDuckGracePeriod >= o.LameDuckDuration {\n\t\treturn fmt.Errorf(\"lame duck grace period (%v) should be strictly lower than lame duck duration (%v)\",\n\t\t\to.LameDuckGracePeriod, o.LameDuckDuration)\n\t}\n\tif int64(o.MaxPayload) > o.MaxPending {\n\t\treturn fmt.Errorf(\"max_payload (%v) cannot be higher than max_pending (%v)\",\n\t\t\to.MaxPayload, o.MaxPending)\n\t}\n\tif o.ServerName != _EMPTY_ && strings.Contains(o.ServerName, \" \") {\n\t\treturn errors.New(\"server name cannot contain spaces\")\n\t}\n\t// Check that the trust configuration is correct.","sourceCodeStart":1142,"sourceCodeEnd":1178,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/server.go#L1142-L1178","documentation":"validatePinnedCerts: a key in tls.pinned_certs, after lowercasing, does not match the regex ^[a-f0-9]{64}$ — i.e. it is not a 64-character lowercase hex SHA-256 fingerprint of the DER-encoded SubjectPublicKeyInfo. Typical causes: uppercase is fine (lowercased first) but wrong length, non-hex characters, 'sha256:' prefixes, or colons/spaces in the fingerprint.","triggerScenarios":"Thrown at server/server.go:1160 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide the fingerprint as exactly 64 hex characters with no separators or prefixes","Compute it via openssl x509 -pubkey | openssl pkey -pubin -outform DER | openssl dgst -sha256 and strip colons","Ensure no leading 'sha256:' label or whitespace in the config entry"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}