{"record":{"id":"d8ff9a0aa9b3f2d6","repo":"microsoft/garnet","slug":"unable-to-load-certificate-with-subject-name-subj","errorCode":null,"errorMessage":"Unable to load certificate with subject name {subjectName}","messagePattern":"Unable to load certificate with subject name (.+?)","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"libs/server/TLS/CertificateUtils.cs","lineNumber":43,"sourceCode":"        /// <param name=\"subjectName\"></param>\n        /// <returns></returns>\n        /// <exception cref=\"ArgumentException\"></exception>\n        public static X509Certificate2 GetMachineCertificateBySubjectName(string subjectName)\n        {\n            X509Store store = null;\n            X509Certificate2 certificate;\n\n            try\n            {\n                store = new X509Store(StoreName.My, StoreLocation.LocalMachine);\n                store.Open(OpenFlags.ReadOnly);\n\n                var certificateCollection = store.Certificates\n                    .Find(X509FindType.FindBySubjectName, subjectName, false);\n\n                if (certificateCollection.Count <= 0)\n                {\n                    throw new ArgumentException(\n                        $\"Unable to load certificate with subject name {subjectName}\");\n                }\n\n                var latestMatchingCert = certificateCollection.OfType<X509Certificate2>().OrderByDescending(cert => cert.NotAfter).First();\n                certificate = new X509Certificate2(latestMatchingCert);\n            }\n            finally\n            {\n                store?.Close();\n            }\n\n            return certificate;\n        }\n\n\n        /// <summary>\n        /// Gets machine certificate by file name. The certificate format (PKCS#12/PFX or PEM) is\n        /// detected from the file's contents rather than trusted from its extension.","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/microsoft/garnet/blob/951b0fc6838721f89d102c2bbe1b914e8d39d700/libs/server/TLS/CertificateUtils.cs#L25-L61","documentation":"Garnet's CertificateUtils searches the Windows certificate store (LocalMachine\\My) by subject name using X509FindType.FindBySubjectName. If zero certificates match, it throws. Note that the search uses validOnly=false, so expired certs are included — the error means no cert with that subject name exists at all. If multiple match, the one with the latest NotAfter date is selected.","triggerScenarios":"Calling GetSslServerCertificate() or constructing ServerCertificateSelector with a CertSubjectName that does not match any certificate in the LocalMachine\\My store. The subject name match is by name string, not thumbprint.","commonSituations":"Typo in the certificate subject name; certificate installed in CurrentUser\\My instead of LocalMachine\\My; certificate installed under a different subject name (CN mismatch); development machine without the production cert; cert was revoked/removed.","solutions":["Verify the certificate exists in LocalMachine\\My by running 'certutil -store My' or PowerShell 'Get-ChildItem Cert:\\LocalMachine\\My'.","Install the certificate with the correct subject name into the LocalMachine\\My store.","Switch to --cert-file-name with a PFX file path instead of subject-name lookup if the cert store is not available.","Check for trailing spaces or case differences in the subject name parameter."],"exampleFix":"// before\n--cert-subject-name garnet.local\n\n// after (fix the name to match the CN in the store)\n--cert-subject-name CN=garnet.local\n// or use a file instead\n--cert-file-name /path/to/cert.pfx --cert-password ********","handlingStrategy":"try-catch","validationCode":"// Pre-check certificate existence (Windows)\nusing var store = new X509Store(StoreName.My, StoreLocation.LocalMachine);\nstore.Open(OpenFlags.ReadOnly);\nvar found = store.Certificates.Find(X509FindType.FindBySubjectName, subjectName, false);\nif (found.Count == 0) throw new FileNotFoundException($\"No certificate with subject '{subjectName}' in LocalMachine\\\\My.\");","typeGuard":null,"tryCatchPattern":"try { var cert = CertificateUtils.GetCertificate(subjectName); }\ncatch (ArgumentException ex) when (ex.Message.Contains(\"Unable to load certificate\"))\n{ logger.LogError(\"Certificate not found for subject {Subject}. Install it or switch to --cert-file-name.\", subjectName); throw; }","preventionTips":["Verify certificate existence with certutil or PowerShell before starting the server.","Use --cert-file-name for cross-platform deployments to avoid store dependency.","Document the exact subject name (including CN= prefix if needed) in deployment runbooks."],"tags":["tls","certificate","security","windows","garnet"],"backgroundTag":null,"analyzedSha":"951b0fc6838721f89d102c2bbe1b914e8d39d700","analyzedAt":"2026-08-13T19:01:32.939Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}