nats-io/nats-server · error

cert store type not implemented

Error message

cert store type not implemented

What it means

ErrBadCertStore is returned when a cert_store string cannot be parsed into a known store type or the parsed store type is not implemented on the current platform. ParseCertStore validates the name against StoreMap and its OS support table; the Windows TLSConfig also rejects unhandled store types.

Source

Thrown at server/certstore/errors.go:57

	ErrBadPublicKeyAlgorithm = errors.New("unsupported public key algorithm")

	// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field
	ErrExtractPropertyFromKey = errors.New("unable to extract property from key")

	// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported
	ErrBadECCCurveName = errors.New("unsupported ECC curve name")

	// ErrFailedCertSearch represents not able to find certificate in store
	ErrFailedCertSearch = errors.New("unable to find certificate in store")

	// ErrFailedX509Extract represents not being able to extract x509 certificate from found cert in store
	ErrFailedX509Extract = errors.New("unable to extract x509 from certificate")

	// ErrBadMatchByType represents unknown CERT_MATCH_BY passed
	ErrBadMatchByType = errors.New("cert match by type not implemented")

	// ErrBadCertStore represents unknown CERT_STORE passed
	ErrBadCertStore = errors.New("cert store type not implemented")

	// ErrConflictCertFileAndStore represents ambiguous configuration of both file and store
	ErrConflictCertFileAndStore = errors.New("'cert_file' and 'cert_store' may not both be configured")

	// ErrBadCertStoreField represents malformed cert_store option
	ErrBadCertStoreField = errors.New("expected 'cert_store' to be a valid non-empty string")

	// ErrBadCertMatchByField represents malformed cert_match_by option
	ErrBadCertMatchByField = errors.New("expected 'cert_match_by' to be a valid non-empty string")

	// ErrBadCertMatchField represents malformed cert_match option
	ErrBadCertMatchField = errors.New("expected 'cert_match' to be a valid non-empty string")

	// ErrBadCaCertMatchField represents malformed cert_match option
	ErrBadCaCertMatchField = errors.New("expected 'ca_certs_match' to be a valid non-empty string array")

	// ErrBadCertMatchSkipInvalidField represents malformed cert_match_skip_invalid option
	ErrBadCertMatchSkipInvalidField = errors.New("expected 'cert_match_skip_invalid' to be a boolean")

View on GitHub (pinned to 3a66a489d2)

Solutions

  1. Set cert_store to a valid Windows value such as 'LocalMachine\My' (or the exact names listed in the library's StoreMap).
  2. Check the OS support table (StoreOSMap) — the configured store type must be supported on the platform the server runs on.
  3. Fix typos and casing-sensitive substore paths in the config.
  4. If a store type is genuinely unimplemented for your platform, switch to cert_file/key_file based TLS config.

Example fix

// before (macOS-style value on Windows)
cert_store: "Keychain"
// after
cert_store: "LocalMachine\\My"
Defensive patterns

Strategy: validation

Validate before calling

switch strings.ToLower(cfg.CertStore) {
case "localmachine\\my", "currentuser\\my": // platform-appropriate values
    // ok
default:
    return fmt.Errorf("cert_store %q not supported on this platform", cfg.CertStore)
}

Type guard

func isBadStoreErr(err error) bool { return errors.Is(err, certstore.ErrBadCertStore) }

Try / catch

_, err := certstore.ParseCertStore(cfg.CertStore)
if errors.Is(err, certstore.ErrBadCertStore) {
    // correct the store name or fall back to cert_file/key_file
}

Prevention

When it happens

Trigger: certstore.go:71 — ParseCertStore gets a string absent from StoreMap (case-insensitive) or one whose OS support entry is missing; certstore_windows.go:260 — TLSConfig receives a store type outside the Windows switch (e.g. a macOS keychain type).

Common situations: Using a platform-inappropriate store name (e.g. 'keychain' on Windows), typos like 'localmachine\Myy', or running a Windows binary with a config written for macOS/Linux.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/b6a0f2df181280a1. Report an issue: GitHub.