{"record":{"id":"c2dbb0570c7c61d6","repo":"nats-io/nats-server","slug":"error-parsing-x509-certificate-key-pair-d-d-v","errorCode":null,"errorMessage":"error parsing X509 certificate/key pair %d/%d: %v","messagePattern":"error parsing X509 certificate/key pair (.+?)/(.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/opts.go","lineNumber":5860,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"error parsing X509 certificate/key pair: %v\", err)\n\t\t}\n\t\tcert.Leaf, err = x509.ParseCertificate(cert.Certificate[0])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error parsing certificate: %v\", err)\n\t\t}\n\t\tconfig.Certificates = []tls.Certificate{cert}\n\tcase tc.CertStore != certstore.STOREEMPTY:\n\t\terr := certstore.TLSConfig(tc.CertStore, tc.CertMatchBy, tc.CertMatch, tc.CaCertsMatch, tc.CertMatchSkipInvalid, &config)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\tcase tc.Certificates != nil:\n\t\t// Multiple certificate support.\n\t\tconfig.Certificates = make([]tls.Certificate, len(tc.Certificates))\n\t\tfor i, certPair := range tc.Certificates {\n\t\t\tcert, err := tls.LoadX509KeyPair(certPair.CertFile, certPair.KeyFile)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error parsing X509 certificate/key pair %d/%d: %v\", i+1, len(tc.Certificates), err)\n\t\t\t}\n\t\t\tcert.Leaf, err = x509.ParseCertificate(cert.Certificate[0])\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error parsing certificate %d/%d: %v\", i+1, len(tc.Certificates), err)\n\t\t\t}\n\t\t\tconfig.Certificates[i] = cert\n\t\t}\n\t}\n\n\t// Require client certificates as needed\n\tif tc.Verify {\n\t\tconfig.ClientAuth = tls.RequireAndVerifyClientCert\n\t}\n\t// Add in CAs if applicable.\n\tif tc.CaFile != _EMPTY_ {\n\t\trootPEM, err := os.ReadFile(tc.CaFile)\n\t\tif err != nil || rootPEM == nil {\n\t\t\treturn nil, err","sourceCodeStart":5842,"sourceCodeEnd":5878,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/opts.go#L5842-L5878","documentation":"In the multi-certificate path (tc.Certificates list), the server loads each pair with tls.LoadX509KeyPair and wraps failures as 'error parsing X509 certificate/key pair %d/%d: %v', identifying which of N pairs failed (1-based index). The wrapped error contains the actual cause.","triggerScenarios":"Providing multiple certificate pairs via the Certificates option where any one pair fails to load — unreadable files, mismatched cert/key, invalid PEM.","commonSituations":"Rotating certificates where one of several SNI pairs was updated incompletely; duplicated config entries pointing at removed files.","solutions":["Fix the failing pair indicated by the first number (i+1) in the message — check file existence, PEM validity, and cert/key matching for that entry","Validate all pairs offline with tls.LoadX509KeyPair in a small test program before restart","Remove stale entries from the certificate list"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"for i, p := range cfg.TLS.Certificates {\n  if _, err := tls.LoadX509KeyPair(p.CertFile, p.KeyFile); err != nil {\n    return fmt.Errorf(\"pair %d/%d invalid: %w\", i+1, len(cfg.TLS.Certificates), err)\n  }\n}","typeGuard":null,"tryCatchPattern":"if err := preflightAllPairs(cfg.TLS.Certificates); err != nil {\n  log.Fatalf(\"multi-cert config invalid: %v\", err)\n}","preventionTips":["Pre-flight load every pair before restart","When rotating, update all entries atomically","Delete entries whose files no longer exist"],"tags":["tls","x509","certificate","config-validation"],"backgroundTag":"tls-keypair-load-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}