{"record":{"id":"b9987f40a38b648f","repo":"nats-io/nats-server","slug":"unable-to-extract-x509-from-certificate","errorCode":null,"errorMessage":"unable to extract x509 from certificate","messagePattern":"unable to extract x509 from certificate","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certstore/errors.go","lineNumber":51,"sourceCode":"\tErrExtractingRSAPublicKey = errors.New(\"unable to extract RSA public key from store\")\n\n\t// ErrExtractingPublicKey represents a general error exporting public key from store\n\tErrExtractingPublicKey = errors.New(\"unable to extract public key from store\")\n\n\t// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm\n\tErrBadPublicKeyAlgorithm = errors.New(\"unsupported public key algorithm\")\n\n\t// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field\n\tErrExtractPropertyFromKey = errors.New(\"unable to extract property from key\")\n\n\t// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported\n\tErrBadECCCurveName = errors.New(\"unsupported ECC curve name\")\n\n\t// ErrFailedCertSearch represents not able to find certificate in store\n\tErrFailedCertSearch = errors.New(\"unable to find certificate in store\")\n\n\t// ErrFailedX509Extract represents not being able to extract x509 certificate from found cert in store\n\tErrFailedX509Extract = errors.New(\"unable to extract x509 from certificate\")\n\n\t// ErrBadMatchByType represents unknown CERT_MATCH_BY passed\n\tErrBadMatchByType = errors.New(\"cert match by type not implemented\")\n\n\t// ErrBadCertStore represents unknown CERT_STORE passed\n\tErrBadCertStore = errors.New(\"cert store type not implemented\")\n\n\t// ErrConflictCertFileAndStore represents ambiguous configuration of both file and store\n\tErrConflictCertFileAndStore = errors.New(\"'cert_file' and 'cert_store' may not both be configured\")\n\n\t// ErrBadCertStoreField represents malformed cert_store option\n\tErrBadCertStoreField = errors.New(\"expected 'cert_store' to be a valid non-empty string\")\n\n\t// ErrBadCertMatchByField represents malformed cert_match_by option\n\tErrBadCertMatchByField = errors.New(\"expected 'cert_match_by' to be a valid non-empty string\")\n\n\t// ErrBadCertMatchField represents malformed cert_match option\n\tErrBadCertMatchField = errors.New(\"expected 'cert_match' to be a valid non-empty string\")","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/errors.go#L33-L69","documentation":"ErrFailedX509Extract is returned when the store found a certificate context but could not convert it into a Go x509.Certificate. certSearch returns it when CertCreateCertificateContext or x509 parsing of the encoded cert blob fails, or when no certificate context survived the search.","triggerScenarios":"certstore_windows.go:491 returns it when x509.ParseCertificate fails on the CryptoAPI-derived DER bytes; :499 returns it when the final cert handle is nil after the search loop.","commonSituations":"Corrupted certificate entries in the Windows store, certificates with malformed extensions Go's parser rejects, or store entries pointing at deleted/invalid contexts.","solutions":["Remove and re-import the offending certificate into the store to eliminate a corrupted entry.","Inspect the cert with `certutil -v -store My <thumbprint>`; re-export to DER/PEM and test `openssl x509 -inform der -in cert.der` to see whether the encoding parses.","Skip invalid certs by enabling cert_match_skip_invalid so a single bad entry does not abort the search.","If Go rejects a valid cert extension, update the library/Go version for newer x509 parsing fixes, or reissue the cert without the problematic extension."],"exampleFix":"// before: bad store entry aborts everything\ncert_match_skip_invalid: false\n// after\ncert_match_skip_invalid: true","handlingStrategy":"try-catch","validationCode":"// Enable skip_invalid so one corrupt entry cannot abort the search\ntls {\n  cert_match_skip_invalid: true\n}","typeGuard":"func isX509ExtractErr(err error) bool { return errors.Is(err, certstore.ErrFailedX509Extract) }","tryCatchPattern":"tc, err := cs.TLSConfig()\nif errors.Is(err, certstore.ErrFailedX509Extract) {\n    // identify corrupt store entry, re-import cert\n}","preventionTips":["Re-import certs rather than editing store entries","Set cert_match_skip_invalid: true in configs scanning many certs","Test parsing exported certs with openssl/x509 after import"],"tags":["windows","certstore","x509","certificate-parsing"],"backgroundTag":"x509-certificate-parse-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}