{"record":{"id":"965555d770dda32d","repo":"nats-io/nats-server","slug":"cert-file-and-cert-store-may-not-both-be-confi","errorCode":null,"errorMessage":"'cert_file' and 'cert_store' may not both be configured","messagePattern":"'cert_file' and 'cert_store' may not both be configured","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certstore/errors.go","lineNumber":60,"sourceCode":"\tErrExtractPropertyFromKey = errors.New(\"unable to extract property from key\")\n\n\t// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported\n\tErrBadECCCurveName = errors.New(\"unsupported ECC curve name\")\n\n\t// ErrFailedCertSearch represents not able to find certificate in store\n\tErrFailedCertSearch = errors.New(\"unable to find certificate in store\")\n\n\t// ErrFailedX509Extract represents not being able to extract x509 certificate from found cert in store\n\tErrFailedX509Extract = errors.New(\"unable to extract x509 from certificate\")\n\n\t// ErrBadMatchByType represents unknown CERT_MATCH_BY passed\n\tErrBadMatchByType = errors.New(\"cert match by type not implemented\")\n\n\t// ErrBadCertStore represents unknown CERT_STORE passed\n\tErrBadCertStore = errors.New(\"cert store type not implemented\")\n\n\t// ErrConflictCertFileAndStore represents ambiguous configuration of both file and store\n\tErrConflictCertFileAndStore = errors.New(\"'cert_file' and 'cert_store' may not both be configured\")\n\n\t// ErrBadCertStoreField represents malformed cert_store option\n\tErrBadCertStoreField = errors.New(\"expected 'cert_store' to be a valid non-empty string\")\n\n\t// ErrBadCertMatchByField represents malformed cert_match_by option\n\tErrBadCertMatchByField = errors.New(\"expected 'cert_match_by' to be a valid non-empty string\")\n\n\t// ErrBadCertMatchField represents malformed cert_match option\n\tErrBadCertMatchField = errors.New(\"expected 'cert_match' to be a valid non-empty string\")\n\n\t// ErrBadCaCertMatchField represents malformed cert_match option\n\tErrBadCaCertMatchField = errors.New(\"expected 'ca_certs_match' to be a valid non-empty string array\")\n\n\t// ErrBadCertMatchSkipInvalidField represents malformed cert_match_skip_invalid option\n\tErrBadCertMatchSkipInvalidField = errors.New(\"expected 'cert_match_skip_invalid' to be a boolean\")\n\n\t// ErrOSNotCompatCertStore represents cert_store passed that exists but is not valid on current OS\n\tErrOSNotCompatCertStore = errors.New(\"cert_store not compatible with current operating system\")","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/errors.go#L42-L78","documentation":"ErrConflictCertFileAndStore is a configuration validation error: TLS options may not specify both cert_file (file-based certificate) and cert_store (Windows store-based certificate), since the two mechanisms are mutually exclusive ways to supply the serving certificate.","triggerScenarios":"server/opts.go:5833 — ProcessOptions/TLS validation returns it when tc.CertFile is non-empty AND tc.CertStore is non-empty in the same tls/remote/cluster TLS config block.","commonSituations":"Merging config fragments where one team added cert_file and another enabled Windows store support, or converting a config from file-based to store-based and leaving the old cert_file line in place.","solutions":["Remove the cert_file (and key_file) entries if you intend store-based certs, keeping only cert_store/cert_match_by/cert_match.","Alternatively remove cert_store if you intend file-based TLS.","For CA trust material remember ca_file and ca_store have analogous exclusivity — keep each TLS block consistent.","Search the config (and any includes/flag overrides) for both keys being set on the same block."],"exampleFix":"// before\ntls {\n  cert_file: \"./cert.pem\"\n  cert_store: \"LocalMachine\\\\My\"\n}\n// after\ntls {\n  cert_store: \"LocalMachine\\\\My\"\n  cert_match_by: \"thumbprint\"\n  cert_match: \"AB12...\"\n}","handlingStrategy":"validation","validationCode":"if cfg.TLS.CertFile != \"\" && cfg.TLS.CertStore != \"\" {\n    return errors.New(\"cert_file and cert_store are mutually exclusive\")\n}","typeGuard":"func isConflictCertFileAndStore(err error) bool { return errors.Is(err, certstore.ErrConflictCertFileAndStore) }","tryCatchPattern":"opts, err := server.ProcessOptions(...)\nif err != nil && strings.Contains(err.Error(), \"may not both be configured\") {\n    // strip one of cert_file/cert_store from config\n}","preventionTips":["Keep one TLS provisioning method per config block","When migrating to cert_store, delete cert_file/key_file lines","Run config validation in CI before rollout"],"tags":["configuration","tls","certstore","conflicting-options"],"backgroundTag":"conflicting-tls-options","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}