nats-io/nats-server · error

Error processing trusted operator keys

Error message

Error processing trusted operator keys

What it means

During NewServer, processTrustedKeys() returned false: the operator/system account key material in the configuration (trusted roots, operator JWTs, system account key chain) could not be validated — e.g. missing system account, unresolvable operator key, or signing-key issues in an operator-secured setup. The server refuses to start; the boolean false hides the specific cause, which is logged earlier.

Source

Thrown at server/server.go:809

	// queue to exist at all times).
	s.delayedAPIResponses = newIPQueue[*delayedAPIResponse](s, "delayed API responses")

	// By default we'll allow account NRG.
	s.accountNRGAllowed.Store(true)

	// Fill up the maximum in flight syncRequests for this server.
	// Used in JetStream catchup semantics.
	for i := 0; i < maxConcurrentSyncRequests; i++ {
		s.syncOutSem <- struct{}{}
	}

	if opts.TLSRateLimit > 0 {
		s.connRateCounter = newRateCounter(opts.tlsConfigOpts.RateLimit)
	}

	// Trusted root operator keys.
	if !s.processTrustedKeys() {
		return nil, fmt.Errorf("Error processing trusted operator keys")
	}

	// If we have solicited leafnodes but no clustering and no clustername.
	// However we may need a stable clustername so use the server name.
	if len(opts.LeafNode.Remotes) > 0 && opts.Cluster.Port == 0 && opts.Cluster.Name == _EMPTY_ {
		s.leafNoCluster = true
		opts.Cluster.Name = opts.ServerName
	}

	if opts.Cluster.Name != _EMPTY_ {
		// Also place into mapping cn with cnMu lock.
		s.cnMu.Lock()
		s.cn = opts.Cluster.Name
		s.cnMu.Unlock()
	}

	s.mu.Lock()
	defer s.mu.Unlock()

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Check the server log lines before this error for the specific key validation failure
2. Verify operator JWT, system account and resolver configuration are consistent
3. Ensure the trusted list contains the operator's public key and required signing keys

When it happens

Trigger: Thrown at server/server.go:809 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/11ef614bffdeb0c2. Report an issue: GitHub.