nats-io/nats-server · error

expected 'ca_certs_match' to be a valid non-empty string arr

Error message

expected 'ca_certs_match' to be a valid non-empty string array

What it means

Sentinel from certstore option parsing: the 'ca_certs_match' field under a cert_store block is not a usable array of match strings — missing, empty, or containing non-string/blank entries. It is a generic config-validation guard; the input at fault is the ca_certs_match option value itself.

Source

Thrown at server/certstore/errors.go:72

	ErrBadMatchByType = errors.New("cert match by type not implemented")

	// ErrBadCertStore represents unknown CERT_STORE passed
	ErrBadCertStore = errors.New("cert store type not implemented")

	// ErrConflictCertFileAndStore represents ambiguous configuration of both file and store
	ErrConflictCertFileAndStore = errors.New("'cert_file' and 'cert_store' may not both be configured")

	// ErrBadCertStoreField represents malformed cert_store option
	ErrBadCertStoreField = errors.New("expected 'cert_store' to be a valid non-empty string")

	// ErrBadCertMatchByField represents malformed cert_match_by option
	ErrBadCertMatchByField = errors.New("expected 'cert_match_by' to be a valid non-empty string")

	// ErrBadCertMatchField represents malformed cert_match option
	ErrBadCertMatchField = errors.New("expected 'cert_match' to be a valid non-empty string")

	// ErrBadCaCertMatchField represents malformed cert_match option
	ErrBadCaCertMatchField = errors.New("expected 'ca_certs_match' to be a valid non-empty string array")

	// ErrBadCertMatchSkipInvalidField represents malformed cert_match_skip_invalid option
	ErrBadCertMatchSkipInvalidField = errors.New("expected 'cert_match_skip_invalid' to be a boolean")

	// ErrOSNotCompatCertStore represents cert_store passed that exists but is not valid on current OS
	ErrOSNotCompatCertStore = errors.New("cert_store not compatible with current operating system")
)

View on GitHub (pinned to 3a66a489d2)

Solutions

  1. Set ca_certs_match to an array of one or more non-empty strings, e.g. ['CN=MyCA']
  2. Remove the field entirely if CA-subject matching is not needed
  3. Check YAML/JSON quoting mistakes that collapse the array into a scalar or empty list
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at server/certstore/errors.go:72 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/998f7700b88e6eb6. Report an issue: GitHub.