{"record":{"id":"bb2130c603c60707","repo":"nats-io/nats-server","slug":"tls-server-certificate-must-be-present-and-valid","errorCode":null,"errorMessage":"TLS Server certificate must be present and valid","messagePattern":"TLS Server certificate must be present and valid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/opts.go","lineNumber":6490,"sourceCode":"\n\treturn opts, nil\n}\n\nfunc normalizeBasePath(p string) string {\n\tif len(p) == 0 {\n\t\treturn \"/\"\n\t}\n\t// add leading slash\n\tif p[0] != '/' {\n\t\tp = \"/\" + p\n\t}\n\treturn path.Clean(p)\n}\n\n// overrideTLS is called when at least \"-tls=true\" has been set.\nfunc overrideTLS(opts *Options) error {\n\tif opts.TLSCert == _EMPTY_ {\n\t\treturn errors.New(\"TLS Server certificate must be present and valid\")\n\t}\n\tif opts.TLSKey == _EMPTY_ {\n\t\treturn errors.New(\"TLS Server private key must be present and valid\")\n\t}\n\n\ttc := TLSConfigOpts{}\n\ttc.CertFile = opts.TLSCert\n\ttc.KeyFile = opts.TLSKey\n\ttc.CaFile = opts.TLSCaCert\n\ttc.Verify = opts.TLSVerify\n\ttc.Ciphers = defaultCipherSuites()\n\n\tvar err error\n\topts.TLSConfig, err = GenTLSConfig(&tc)\n\treturn err\n}\n\n// overrideCluster updates Options.Cluster if that flag \"cluster\" (or \"cluster_listen\")","sourceCodeStart":6472,"sourceCodeEnd":6508,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/opts.go#L6472-L6508","documentation":"overrideTLS runs because -tls=true was set (tlsOverride) but opts.TLSCert is empty — TLS cannot be configured without a server certificate. The missing TLSCert option (e.g. --tlscert / cert_file) is the input at fault.","triggerScenarios":"Thrown at server/opts.go:6490 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Supply the server certificate, e.g. --tlscert server.pem","Configure cert_file/key_file in the TLS block instead of the -tls override","Drop -tls=true if TLS was not intended"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}