{"record":{"id":"a9db9c04842d9899","repo":"nats-io/nats-server","slug":"tls-server-private-key-must-be-present-and-valid","errorCode":null,"errorMessage":"TLS Server private key must be present and valid","messagePattern":"TLS Server private key must be present and valid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/opts.go","lineNumber":6493,"sourceCode":"\nfunc normalizeBasePath(p string) string {\n\tif len(p) == 0 {\n\t\treturn \"/\"\n\t}\n\t// add leading slash\n\tif p[0] != '/' {\n\t\tp = \"/\" + p\n\t}\n\treturn path.Clean(p)\n}\n\n// overrideTLS is called when at least \"-tls=true\" has been set.\nfunc overrideTLS(opts *Options) error {\n\tif opts.TLSCert == _EMPTY_ {\n\t\treturn errors.New(\"TLS Server certificate must be present and valid\")\n\t}\n\tif opts.TLSKey == _EMPTY_ {\n\t\treturn errors.New(\"TLS Server private key must be present and valid\")\n\t}\n\n\ttc := TLSConfigOpts{}\n\ttc.CertFile = opts.TLSCert\n\ttc.KeyFile = opts.TLSKey\n\ttc.CaFile = opts.TLSCaCert\n\ttc.Verify = opts.TLSVerify\n\ttc.Ciphers = defaultCipherSuites()\n\n\tvar err error\n\topts.TLSConfig, err = GenTLSConfig(&tc)\n\treturn err\n}\n\n// overrideCluster updates Options.Cluster if that flag \"cluster\" (or \"cluster_listen\")\n// has explicitly be set in the command line. If it is set to empty string, it will\n// clear the Cluster options.\nfunc overrideCluster(opts *Options) error {","sourceCodeStart":6475,"sourceCodeEnd":6511,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/opts.go#L6475-L6511","documentation":"overrideTLS: -tls=true is active and a certificate was supplied, but opts.TLSKey is empty — the private key matching the certificate is missing, so the TLS configuration cannot be built.","triggerScenarios":"Thrown at server/opts.go:6493 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Supply the private key, e.g. --tlskey server.key","Set key_file alongside cert_file in the TLS config block","Check for misspelled flag or option names"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}