{"record":{"id":"fedc58e570773f70","repo":"nats-io/nats-server","slug":"error-parsing-certificate-v-fedc58","errorCode":null,"errorMessage":"error parsing certificate: %v","messagePattern":"error parsing certificate: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/opts.go","lineNumber":5846,"sourceCode":"\t\tInsecureSkipVerify: tc.Insecure,\n\t}\n\n\tswitch {\n\tcase tc.CertFile != _EMPTY_ && tc.CertStore != certstore.STOREEMPTY:\n\t\treturn nil, certstore.ErrConflictCertFileAndStore\n\tcase tc.CertFile != _EMPTY_ && tc.KeyFile == _EMPTY_:\n\t\treturn nil, fmt.Errorf(\"missing 'key_file' in TLS configuration\")\n\tcase tc.CertFile == _EMPTY_ && tc.KeyFile != _EMPTY_:\n\t\treturn nil, fmt.Errorf(\"missing 'cert_file' in TLS configuration\")\n\tcase tc.CertFile != _EMPTY_ && tc.KeyFile != _EMPTY_:\n\t\t// Now load in cert and private key\n\t\tcert, err := tls.LoadX509KeyPair(tc.CertFile, tc.KeyFile)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error parsing X509 certificate/key pair: %v\", err)\n\t\t}\n\t\tcert.Leaf, err = x509.ParseCertificate(cert.Certificate[0])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error parsing certificate: %v\", err)\n\t\t}\n\t\tconfig.Certificates = []tls.Certificate{cert}\n\tcase tc.CertStore != certstore.STOREEMPTY:\n\t\terr := certstore.TLSConfig(tc.CertStore, tc.CertMatchBy, tc.CertMatch, tc.CaCertsMatch, tc.CertMatchSkipInvalid, &config)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\tcase tc.Certificates != nil:\n\t\t// Multiple certificate support.\n\t\tconfig.Certificates = make([]tls.Certificate, len(tc.Certificates))\n\t\tfor i, certPair := range tc.Certificates {\n\t\t\tcert, err := tls.LoadX509KeyPair(certPair.CertFile, certPair.KeyFile)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error parsing X509 certificate/key pair %d/%d: %v\", i+1, len(tc.Certificates), err)\n\t\t\t}\n\t\t\tcert.Leaf, err = x509.ParseCertificate(cert.Certificate[0])\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error parsing certificate %d/%d: %v\", i+1, len(tc.Certificates), err)","sourceCodeStart":5828,"sourceCodeEnd":5864,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/opts.go#L5828-L5864","documentation":"After successfully loading the key pair, the server parses the first DER certificate into an x509.Certificate leaf (needed for SAN-based matching). If x509.ParseCertificate fails, this error is returned. It means the certificate bytes are corrupt or not a supported X.509 structure.","triggerScenarios":"parseTLS: cert.Leaf, err = x509.ParseCertificate(cert.Certificate[0]) returning err, i.e. malformed or unsupported certificate data in cert_file.","commonSituations":"Corrupted certificates from truncated downloads; exotic encodings or unsupported signature algorithms; mis-ordered PEM concatenation causing wrong first block.","solutions":["Inspect cert_file with 'openssl x509 -in server.pem -text -noout' and re-export a clean PEM","Ensure cert_file starts with the leaf certificate, not an intermediate","Replace the certificate file from a trusted source and reload"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"pemBytes, _ := os.ReadFile(cfg.TLS.CertFile)\nblock, _ := pem.Decode(pemBytes)\nif block == nil || block.Type != \"CERTIFICATE\" { return errors.New(\"cert_file missing CERTIFICATE PEM block\") }\nif _, err := x509.ParseCertificate(block.Bytes); err != nil { return err }","typeGuard":null,"tryCatchPattern":"if _, err := x509.ParseCertificate(block.Bytes); err != nil {\n  return fmt.Errorf(\"malformed certificate in %s: %w\", path, err)\n}","preventionTips":["Verify PEMs with 'openssl x509 -text' before shipping","Ensure leaf certificate is first in cert_file","Re-download corrupted certs from the source CA"],"tags":["tls","x509","certificate"],"backgroundTag":"x509-parse-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}