{"record":{"id":"a0e54eefa742dd8f","repo":"nats-io/nats-server","slug":"unable-to-find-certificate-in-store","errorCode":null,"errorMessage":"unable to find certificate in store","messagePattern":"unable to find certificate in store","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certstore/errors.go","lineNumber":48,"sourceCode":"\tErrExtractingECCPublicKey = errors.New(\"unable to extract ECC public key from store\")\n\n\t// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store\n\tErrExtractingRSAPublicKey = errors.New(\"unable to extract RSA public key from store\")\n\n\t// ErrExtractingPublicKey represents a general error exporting public key from store\n\tErrExtractingPublicKey = errors.New(\"unable to extract public key from store\")\n\n\t// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm\n\tErrBadPublicKeyAlgorithm = errors.New(\"unsupported public key algorithm\")\n\n\t// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field\n\tErrExtractPropertyFromKey = errors.New(\"unable to extract property from key\")\n\n\t// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported\n\tErrBadECCCurveName = errors.New(\"unsupported ECC curve name\")\n\n\t// ErrFailedCertSearch represents not able to find certificate in store\n\tErrFailedCertSearch = errors.New(\"unable to find certificate in store\")\n\n\t// ErrFailedX509Extract represents not being able to extract x509 certificate from found cert in store\n\tErrFailedX509Extract = errors.New(\"unable to extract x509 from certificate\")\n\n\t// ErrBadMatchByType represents unknown CERT_MATCH_BY passed\n\tErrBadMatchByType = errors.New(\"cert match by type not implemented\")\n\n\t// ErrBadCertStore represents unknown CERT_STORE passed\n\tErrBadCertStore = errors.New(\"cert store type not implemented\")\n\n\t// ErrConflictCertFileAndStore represents ambiguous configuration of both file and store\n\tErrConflictCertFileAndStore = errors.New(\"'cert_file' and 'cert_store' may not both be configured\")\n\n\t// ErrBadCertStoreField represents malformed cert_store option\n\tErrBadCertStoreField = errors.New(\"expected 'cert_store' to be a valid non-empty string\")\n\n\t// ErrBadCertMatchByField represents malformed cert_match_by option\n\tErrBadCertMatchByField = errors.New(\"expected 'cert_match_by' to be a valid non-empty string\")","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/errors.go#L30-L66","documentation":"ErrFailedCertSearch means the Windows certificate store lookup found no usable certificate matching the configured store/cert_match criteria. It is returned by TLSConfig, winFindCert, caCertsBySubjectMatch and certSearch when the store enumerates to nothing usable, the leaf context is nil, or CryptoAPI reports CRYPT_E_NOT_FOUND.","triggerScenarios":"cs.TLSConfig -> certSearch/winFindCert: certstore_windows.go:242 returns it when leaf or leafCtx is nil; :333 translates a syscall.Errno(winCryptENotFound) — and any other search error — into this sentinel.","commonSituations":"Typo in cert_match thumbprint/subject, certificate in the wrong store (CurrentUser vs LocalMachine, My vs Root), cert expired/removed, or running as a service account that cannot see the user's store.","solutions":["Verify the certificate exists where you point: run `certutil -store My` / `certlm.msc` and compare thumbprint/subject with your cert_match value (case/whitespace matters).","Confirm the certstore option names the correct store (e.g. 'LocalMachine\\My') for where the cert actually resides.","If the server runs as a Windows service, import the cert into the machine store or the service account's store — CurrentUser stores are per-user.","Check that the certificate is valid (not expired) and has a private key if used for the serving side."],"exampleFix":"// before\ncert_store: \"CurrentUser\\My\"\ncert_match: \"AB12...\"\n// after (cert actually lives in machine store)\ncert_store: \"LocalMachine\\My\"\ncert_match: \"ab12...\"  // thumbprint without spaces, correct case","handlingStrategy":"validation","validationCode":"// Verify cert exists in the target store before configuring\n// certutil -user -store My | findstr /i \"<thumbprint>\"\n// certutil -store My | findstr /i \"<thumbprint>\"\nout := exec.Command(\"certutil\", \"-store\", \"My\").Run()\n_ = out // ensure thumbprint appears for the chosen store","typeGuard":"func isCertNotFound(err error) bool { return errors.Is(err, certstore.ErrFailedCertSearch) }","tryCatchPattern":"tc, err := cs.TLSConfig()\nif errors.Is(err, certstore.ErrFailedCertSearch) {\n    // log store + match values, optionally fall back to cert_file\n}","preventionTips":["Store certs in LocalMachine\\My for services, not CurrentUser","Copy thumbprints without spaces and verify case","Re-verify after cert renewal — thumbprints change","Check expiry monitoring on store certs"],"tags":["windows","certstore","certificate-not-found","tls"],"backgroundTag":"certificate-not-found","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}