{"record":{"id":"ebbb8f5ab19d266e","repo":"nats-io/nats-server","slug":"unable-to-match-any-ca-certificate-v","errorCode":null,"errorMessage":"unable to match any CA certificate: %v","messagePattern":"unable to match any CA certificate: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certstore/certstore_windows.go","lineNumber":188,"sourceCode":"// adding all matching certificates from the caCertsMatch array to the pool.\n// All matching certificates (vs first) are added to the pool based on a user\n// request. If no certificates are found an error is returned.\nfunc createCACertsPool(cs *winCertStore, storeType uint32, caCertsMatch []string, skipInvalid bool) (*x509.CertPool, error) {\n\tvar errs []error\n\tcaPool := x509.NewCertPool()\n\tfor _, s := range caCertsMatch {\n\t\tlfs, err := cs.caCertsBySubjectMatch(s, storeType, skipInvalid)\n\t\tif err != nil {\n\t\t\terrs = append(errs, err)\n\t\t} else {\n\t\t\tfor _, lf := range lfs {\n\t\t\t\tcaPool.AddCert(lf)\n\t\t\t}\n\t\t}\n\t}\n\t// If every lookup failed return the errors.\n\tif len(errs) == len(caCertsMatch) {\n\t\treturn nil, fmt.Errorf(\"unable to match any CA certificate: %v\", errs)\n\t}\n\treturn caPool, nil\n}\n\n// TLSConfig fulfills the same function as reading cert and key pair from\n// pem files but sources the Windows certificate store instead. The\n// certMatchBy and certMatch fields search the \"MY\" certificate location\n// for the first certificate that matches the certMatch field. The\n// caCertsMatch field is used to search the Trusted Root, Third Party Root,\n// and Intermediate Certificate Authority locations for certificates with\n// Subjects matching the provided strings. If a match is found, the\n// certificate is added to the pool that is used to verify the certificate\n// chain.\nfunc TLSConfig(certStore StoreType, certMatchBy MatchByType, certMatch string, caCertsMatch []string, skipInvalid bool, config *tls.Config) error {\n\tvar (\n\t\tleaf     *x509.Certificate\n\t\tleafCtx  *windows.CertContext\n\t\tpk       *winKey","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/certstore_windows.go#L170-L206","documentation":"Windows cert store pool creation: none of the subject-match strings in caCertsMatch yielded a usable certificate from the CA store (each lookup failed or matched nothing), so an empty CA pool cannot be built.","triggerScenarios":"Thrown at server/certstore/certstore_windows.go:188 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the CA certificate subjects configured for matching exist in the Windows store","Import the required CA certificates into the system store","Adjust caCertsMatch patterns to match actual certificate subjects"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}