{"record":{"id":"b6a0f2df181280a1","repo":"nats-io/nats-server","slug":"cert-store-type-not-implemented","errorCode":null,"errorMessage":"cert store type not implemented","messagePattern":"cert store type not implemented","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certstore/errors.go","lineNumber":57,"sourceCode":"\tErrBadPublicKeyAlgorithm = errors.New(\"unsupported public key algorithm\")\n\n\t// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field\n\tErrExtractPropertyFromKey = errors.New(\"unable to extract property from key\")\n\n\t// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported\n\tErrBadECCCurveName = errors.New(\"unsupported ECC curve name\")\n\n\t// ErrFailedCertSearch represents not able to find certificate in store\n\tErrFailedCertSearch = errors.New(\"unable to find certificate in store\")\n\n\t// ErrFailedX509Extract represents not being able to extract x509 certificate from found cert in store\n\tErrFailedX509Extract = errors.New(\"unable to extract x509 from certificate\")\n\n\t// ErrBadMatchByType represents unknown CERT_MATCH_BY passed\n\tErrBadMatchByType = errors.New(\"cert match by type not implemented\")\n\n\t// ErrBadCertStore represents unknown CERT_STORE passed\n\tErrBadCertStore = errors.New(\"cert store type not implemented\")\n\n\t// ErrConflictCertFileAndStore represents ambiguous configuration of both file and store\n\tErrConflictCertFileAndStore = errors.New(\"'cert_file' and 'cert_store' may not both be configured\")\n\n\t// ErrBadCertStoreField represents malformed cert_store option\n\tErrBadCertStoreField = errors.New(\"expected 'cert_store' to be a valid non-empty string\")\n\n\t// ErrBadCertMatchByField represents malformed cert_match_by option\n\tErrBadCertMatchByField = errors.New(\"expected 'cert_match_by' to be a valid non-empty string\")\n\n\t// ErrBadCertMatchField represents malformed cert_match option\n\tErrBadCertMatchField = errors.New(\"expected 'cert_match' to be a valid non-empty string\")\n\n\t// ErrBadCaCertMatchField represents malformed cert_match option\n\tErrBadCaCertMatchField = errors.New(\"expected 'ca_certs_match' to be a valid non-empty string array\")\n\n\t// ErrBadCertMatchSkipInvalidField represents malformed cert_match_skip_invalid option\n\tErrBadCertMatchSkipInvalidField = errors.New(\"expected 'cert_match_skip_invalid' to be a boolean\")","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/errors.go#L39-L75","documentation":"ErrBadCertStore is returned when a cert_store string cannot be parsed into a known store type or the parsed store type is not implemented on the current platform. ParseCertStore validates the name against StoreMap and its OS support table; the Windows TLSConfig also rejects unhandled store types.","triggerScenarios":"certstore.go:71 — ParseCertStore gets a string absent from StoreMap (case-insensitive) or one whose OS support entry is missing; certstore_windows.go:260 — TLSConfig receives a store type outside the Windows switch (e.g. a macOS keychain type).","commonSituations":"Using a platform-inappropriate store name (e.g. 'keychain' on Windows), typos like 'localmachine\\Myy', or running a Windows binary with a config written for macOS/Linux.","solutions":["Set cert_store to a valid Windows value such as 'LocalMachine\\My' (or the exact names listed in the library's StoreMap).","Check the OS support table (StoreOSMap) — the configured store type must be supported on the platform the server runs on.","Fix typos and casing-sensitive substore paths in the config.","If a store type is genuinely unimplemented for your platform, switch to cert_file/key_file based TLS config."],"exampleFix":"// before (macOS-style value on Windows)\ncert_store: \"Keychain\"\n// after\ncert_store: \"LocalMachine\\\\My\"","handlingStrategy":"validation","validationCode":"switch strings.ToLower(cfg.CertStore) {\ncase \"localmachine\\\\my\", \"currentuser\\\\my\": // platform-appropriate values\n    // ok\ndefault:\n    return fmt.Errorf(\"cert_store %q not supported on this platform\", cfg.CertStore)\n}","typeGuard":"func isBadStoreErr(err error) bool { return errors.Is(err, certstore.ErrBadCertStore) }","tryCatchPattern":"_, err := certstore.ParseCertStore(cfg.CertStore)\nif errors.Is(err, certstore.ErrBadCertStore) {\n    // correct the store name or fall back to cert_file/key_file\n}","preventionTips":["Use store names from the library's StoreMap for the target OS","Keep separate configs per platform instead of sharing one","Validate config at deploy time, not at runtime failure"],"tags":["windows","certstore","configuration","invalid-value"],"backgroundTag":"invalid-config-value","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}