{"record":{"id":"354343f4ebab53c1","repo":"nats-io/nats-server","slug":"cert-match-by-type-not-implemented","errorCode":null,"errorMessage":"cert match by type not implemented","messagePattern":"cert match by type not implemented","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certstore/errors.go","lineNumber":54,"sourceCode":"\tErrExtractingPublicKey = errors.New(\"unable to extract public key from store\")\n\n\t// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm\n\tErrBadPublicKeyAlgorithm = errors.New(\"unsupported public key algorithm\")\n\n\t// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field\n\tErrExtractPropertyFromKey = errors.New(\"unable to extract property from key\")\n\n\t// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported\n\tErrBadECCCurveName = errors.New(\"unsupported ECC curve name\")\n\n\t// ErrFailedCertSearch represents not able to find certificate in store\n\tErrFailedCertSearch = errors.New(\"unable to find certificate in store\")\n\n\t// ErrFailedX509Extract represents not being able to extract x509 certificate from found cert in store\n\tErrFailedX509Extract = errors.New(\"unable to extract x509 from certificate\")\n\n\t// ErrBadMatchByType represents unknown CERT_MATCH_BY passed\n\tErrBadMatchByType = errors.New(\"cert match by type not implemented\")\n\n\t// ErrBadCertStore represents unknown CERT_STORE passed\n\tErrBadCertStore = errors.New(\"cert store type not implemented\")\n\n\t// ErrConflictCertFileAndStore represents ambiguous configuration of both file and store\n\tErrConflictCertFileAndStore = errors.New(\"'cert_file' and 'cert_store' may not both be configured\")\n\n\t// ErrBadCertStoreField represents malformed cert_store option\n\tErrBadCertStoreField = errors.New(\"expected 'cert_store' to be a valid non-empty string\")\n\n\t// ErrBadCertMatchByField represents malformed cert_match_by option\n\tErrBadCertMatchByField = errors.New(\"expected 'cert_match_by' to be a valid non-empty string\")\n\n\t// ErrBadCertMatchField represents malformed cert_match option\n\tErrBadCertMatchField = errors.New(\"expected 'cert_match' to be a valid non-empty string\")\n\n\t// ErrBadCaCertMatchField represents malformed cert_match option\n\tErrBadCaCertMatchField = errors.New(\"expected 'ca_certs_match' to be a valid non-empty string array\")","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/errors.go#L36-L72","documentation":"ErrBadMatchByType is returned when a cert_match_by string cannot be mapped to a CERT_MATCH_BY constant, or when TLSConfig is given a match-by type the platform implementation does not handle. ParseCertMatchBy validates against MatchByMap; the Windows TLSConfig dispatch rejects unmatched types.","triggerScenarios":"certstore.go:83 — ParseCertMatchBy(certMatchBy) with a string not in MatchByMap (after lowercasing); certstore_windows.go:235 — TLSConfig encounters a parsed match type not implemented in the windows switch (thumbprint/subject only).","commonSituations":"Config typo like cert_match_by: \"Thumbprint \" (extra space is fine after ToLower, but \"sha1\", \"serial\" etc. are unsupported), or copying match_by values from another product's config format.","solutions":["Set cert_match_by to a supported value — check the library's MatchByMap (e.g. 'thumbprint', 'subject') and fix spelling.","Remove leading/trailing whitespace from cert_match_by in the config file.","Confirm the platform build supports the chosen match type (Windows implementation covers only its switch cases).","If you need another matching strategy, match by subject or upgrade to a version adding it."],"exampleFix":"// before\ncert_match_by: \"sha1_thumbprint\"\n// after\ncert_match_by: \"thumbprint\"","handlingStrategy":"validation","validationCode":"switch strings.ToLower(cfg.CertMatchBy) {\ncase \"thumbprint\", \"subject\":\n    // supported\ndefault:\n    return fmt.Errorf(\"cert_match_by must be thumbprint or subject, got %q\", cfg.CertMatchBy)\n}","typeGuard":"func isBadMatchByErr(err error) bool { return errors.Is(err, certstore.ErrBadMatchByType) }","tryCatchPattern":"_, err := certstore.ParseCertMatchBy(cfg.CertMatchBy)\nif errors.Is(err, certstore.ErrBadMatchByType) {\n    // fix config before starting server\n}","preventionTips":["Only use match-by values documented in the library's MatchByMap","Trim whitespace from config string values","Lint configs against a schema before deploy"],"tags":["windows","certstore","configuration","invalid-value"],"backgroundTag":"invalid-config-value","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}