{"record":{"id":"e17c184f3c09f065","repo":"nats-io/nats-server","slug":"certificate-not-pinned","errorCode":null,"errorMessage":"certificate not pinned","messagePattern":"certificate not pinned","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/errors.go","lineNumber":213,"sourceCode":"\tErrClusterNameRemoteConflict = errors.New(\"cluster name from remote server conflicts\")\n\n\t// ErrClusterNameHasSpaces signals that the cluster name contains spaces, which is not allowed.\n\tErrClusterNameHasSpaces = errors.New(\"cluster name cannot contain spaces\")\n\n\t// ErrClusterNameReserved signals that the cluster name is reserved for internal protocol use.\n\tErrClusterNameReserved = errors.New(\"cluster name is reserved\")\n\n\t// ErrMalformedSubject is returned when a subscription is made with a subject that does not conform to subject rules.\n\tErrMalformedSubject = errors.New(\"malformed subject\")\n\n\t// ErrSubscribePermissionViolation is returned when processing of a subscription fails due to permissions.\n\tErrSubscribePermissionViolation = errors.New(\"subscribe permission violation\")\n\n\t// ErrNoTransforms signals no subject transforms are available to map this subject.\n\tErrNoTransforms = errors.New(\"no matching transforms available\")\n\n\t// ErrCertNotPinned is returned when pinned certs are set and the certificate is not in it\n\tErrCertNotPinned = errors.New(\"certificate not pinned\")\n\n\t// ErrDuplicateServerName is returned when processing a server remote connection and\n\t// the server reports that this server name is already used in the cluster.\n\tErrDuplicateServerName = errors.New(\"duplicate server name\")\n\n\t// ErrMinimumVersionRequired is returned when a connection is not at the minimum version required.\n\tErrMinimumVersionRequired = errors.New(\"minimum version required\")\n\t// ErrLeafNodeMinVersionRejected is the leafnode protocol error prefix used\n\t// when rejecting a remote due to leafnodes.min_version.\n\tErrLeafNodeMinVersionRejected = errors.New(\"connection rejected since minimum version required is\")\n\n\t// ErrInvalidMappingDestination is used for all subject mapping destination errors\n\tErrInvalidMappingDestination = errors.New(\"invalid mapping destination\")\n\n\t// ErrInvalidMappingDestinationSubject is used to error on a bad transform destination mapping\n\tErrInvalidMappingDestinationSubject = fmt.Errorf(\"%w: invalid transform\", ErrInvalidMappingDestination)\n\n\t// ErrMappingDestinationNotUsingAllWildcards is used to error on a transform destination not using all of the token wildcards","sourceCodeStart":195,"sourceCodeEnd":231,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/errors.go#L195-L231","documentation":"TLS handshake check: the peer's presented certificate chain does not match the certificate pin(s) configured for this connection (matchesPinnedCert failed), so the handshake is rejected. The peer's certificate and the configured pin are the mismatched inputs.","triggerScenarios":"Thrown at server/errors.go:213 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Update the configured pin to the peer's current certificate","Renew or re-issue the peer certificate to match the pin","Verify pin values were copied correctly into the configuration"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}