{"record":{"id":"aba4f2ece04a1484","repo":"nats-io/nats-server","slug":"missing-key-file-in-tls-configuration","errorCode":null,"errorMessage":"missing 'key_file' in TLS configuration","messagePattern":"missing 'key_file' in TLS configuration","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/opts.go","lineNumber":5835,"sourceCode":"}\n\n// GenTLSConfig loads TLS related configuration parameters.\nfunc GenTLSConfig(tc *TLSConfigOpts) (*tls.Config, error) {\n\t// Create the tls.Config from our options before including the certs.\n\t// It will determine the cipher suites that we prefer.\n\t// FIXME(dlc) change if ARM based.\n\tconfig := tls.Config{\n\t\tMinVersion:         tls.VersionTLS12,\n\t\tCipherSuites:       tc.Ciphers,\n\t\tCurvePreferences:   tc.CurvePreferences,\n\t\tInsecureSkipVerify: tc.Insecure,\n\t}\n\n\tswitch {\n\tcase tc.CertFile != _EMPTY_ && tc.CertStore != certstore.STOREEMPTY:\n\t\treturn nil, certstore.ErrConflictCertFileAndStore\n\tcase tc.CertFile != _EMPTY_ && tc.KeyFile == _EMPTY_:\n\t\treturn nil, fmt.Errorf(\"missing 'key_file' in TLS configuration\")\n\tcase tc.CertFile == _EMPTY_ && tc.KeyFile != _EMPTY_:\n\t\treturn nil, fmt.Errorf(\"missing 'cert_file' in TLS configuration\")\n\tcase tc.CertFile != _EMPTY_ && tc.KeyFile != _EMPTY_:\n\t\t// Now load in cert and private key\n\t\tcert, err := tls.LoadX509KeyPair(tc.CertFile, tc.KeyFile)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error parsing X509 certificate/key pair: %v\", err)\n\t\t}\n\t\tcert.Leaf, err = x509.ParseCertificate(cert.Certificate[0])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error parsing certificate: %v\", err)\n\t\t}\n\t\tconfig.Certificates = []tls.Certificate{cert}\n\tcase tc.CertStore != certstore.STOREEMPTY:\n\t\terr := certstore.TLSConfig(tc.CertStore, tc.CertMatchBy, tc.CertMatch, tc.CaCertsMatch, tc.CertMatchSkipInvalid, &config)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}","sourceCodeStart":5817,"sourceCodeEnd":5853,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/opts.go#L5817-L5853","documentation":"During TLS config building (parseTLS/GenericTLSConfig), if cert_file is set but key_file is empty, the server returns this error. A TLS certificate without its matching private key cannot form a usable key pair, so the server rejects the configuration.","triggerScenarios":"TLS block specifying cert_file but omitting key_file, e.g. tc.CertFile != \"\" && tc.KeyFile == \"\" in server/opts.go:5835.","commonSituations":"Incomplete TLS sections in nats-server config; keys stored elsewhere (e.g. hardware/keystore) with only the cert path given; copy-paste dropping the key line.","solutions":["Add key_file pointing to the PEM private key alongside cert_file","If using a cert store instead, remove cert_file and set cert_store","Verify both paths exist and are readable by the server process"],"exampleFix":"// before\nhttps: 8443\ntls { cert_file: \"/certs/server.pem\" }\n// after\ntls {\n  cert_file: \"/certs/server.pem\"\n  key_file: \"/certs/server.key\"\n}","handlingStrategy":"validation","validationCode":"if cfg.TLS.CertFile != \"\" && cfg.TLS.KeyFile == \"\" {\n  return fmt.Errorf(\"cert_file set but key_file missing\")\n}","typeGuard":null,"tryCatchPattern":"if err := validateTLSPairs(cfg.TLS); err != nil { log.Fatalf(\"tls config: %v\", err) }","preventionTips":["Always set cert_file and key_file together in config templates","Use shared TLS config snippets to keep pairs consistent","Verify files exist before server start"],"tags":["tls","config-validation","missing-file"],"backgroundTag":"missing-tls-key-file","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}