{"record":{"id":"df112387f4dbfb9f","repo":"nats-io/nats-server","slug":"expected-cert-store-to-be-a-valid-non-empty-stri","errorCode":null,"errorMessage":"expected 'cert_store' to be a valid non-empty string","messagePattern":"expected 'cert_store' to be a valid non-empty string","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certstore/errors.go","lineNumber":63,"sourceCode":"\tErrBadECCCurveName = errors.New(\"unsupported ECC curve name\")\n\n\t// ErrFailedCertSearch represents not able to find certificate in store\n\tErrFailedCertSearch = errors.New(\"unable to find certificate in store\")\n\n\t// ErrFailedX509Extract represents not being able to extract x509 certificate from found cert in store\n\tErrFailedX509Extract = errors.New(\"unable to extract x509 from certificate\")\n\n\t// ErrBadMatchByType represents unknown CERT_MATCH_BY passed\n\tErrBadMatchByType = errors.New(\"cert match by type not implemented\")\n\n\t// ErrBadCertStore represents unknown CERT_STORE passed\n\tErrBadCertStore = errors.New(\"cert store type not implemented\")\n\n\t// ErrConflictCertFileAndStore represents ambiguous configuration of both file and store\n\tErrConflictCertFileAndStore = errors.New(\"'cert_file' and 'cert_store' may not both be configured\")\n\n\t// ErrBadCertStoreField represents malformed cert_store option\n\tErrBadCertStoreField = errors.New(\"expected 'cert_store' to be a valid non-empty string\")\n\n\t// ErrBadCertMatchByField represents malformed cert_match_by option\n\tErrBadCertMatchByField = errors.New(\"expected 'cert_match_by' to be a valid non-empty string\")\n\n\t// ErrBadCertMatchField represents malformed cert_match option\n\tErrBadCertMatchField = errors.New(\"expected 'cert_match' to be a valid non-empty string\")\n\n\t// ErrBadCaCertMatchField represents malformed cert_match option\n\tErrBadCaCertMatchField = errors.New(\"expected 'ca_certs_match' to be a valid non-empty string array\")\n\n\t// ErrBadCertMatchSkipInvalidField represents malformed cert_match_skip_invalid option\n\tErrBadCertMatchSkipInvalidField = errors.New(\"expected 'cert_match_skip_invalid' to be a boolean\")\n\n\t// ErrOSNotCompatCertStore represents cert_store passed that exists but is not valid on current OS\n\tErrOSNotCompatCertStore = errors.New(\"cert_store not compatible with current operating system\")\n)\n","sourceCodeStart":45,"sourceCodeEnd":80,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/errors.go#L45-L80","documentation":"ErrBadCertStoreField is a config-validation error raised when the cert_store option in a TLS block is not a string or is the empty string. It is reported as a configErr with the offending token so the operator knows which field to fix.","triggerScenarios":"server/opts.go:5274 — parsing a TLS config map: the cert_store value is not a Go string (e.g. a number/bool) or is _EMPTY_, so the validator returns &configErr{tk, certstore.ErrBadCertStoreField.Error()} before ParseCertStore is ever called.","commonSituations":"YAML unquoted values interpreted as non-strings, env-var substitution leaving the value empty, or a copy/paste that dropped the store path entirely.","solutions":["Ensure cert_store is a quoted, non-empty string, e.g. cert_store: \"LocalMachine\\\\My\".","If using environment variables ($CERT_STORE), verify the variable is set and non-empty in the server's environment.","Quote the value in YAML/JSON so it is not parsed as another type.","Run the config through `nats-server --signal reload` or `nats-server -t` style validation to catch the bad token before startup."],"exampleFix":"// before\ncert_store: ${CERT_STORE}   # unset env => empty\n// after (yaml)\ncert_store: \"LocalMachine\\\\My\"","handlingStrategy":"validation","validationCode":"if s, ok := cfg.TLS.CertStore.(string); !ok || s == \"\" {\n    return errors.New(\"cert_store must be a non-empty string\")\n}","typeGuard":"func isBadCertStoreField(err error) bool { return errors.Is(err, certstore.ErrBadCertStoreField) }","tryCatchPattern":"if ce, ok := err.(*server.configErr); ok && strings.Contains(ce.Error(), \"cert_store\") {\n    // fix the token/line reported by configErr\n}","preventionTips":["Quote string config values in YAML/JSON","Fail fast if env substitutions resolve empty","Use typed config structs with validation tags"],"tags":["configuration","tls","validation","certstore"],"backgroundTag":"invalid-config-value","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}