nats-io/nats-server · error

expected 'cert_store' to be a valid non-empty string

Error message

expected 'cert_store' to be a valid non-empty string

What it means

ErrBadCertStoreField is a config-validation error raised when the cert_store option in a TLS block is not a string or is the empty string. It is reported as a configErr with the offending token so the operator knows which field to fix.

Source

Thrown at server/certstore/errors.go:63

	ErrBadECCCurveName = errors.New("unsupported ECC curve name")

	// ErrFailedCertSearch represents not able to find certificate in store
	ErrFailedCertSearch = errors.New("unable to find certificate in store")

	// ErrFailedX509Extract represents not being able to extract x509 certificate from found cert in store
	ErrFailedX509Extract = errors.New("unable to extract x509 from certificate")

	// ErrBadMatchByType represents unknown CERT_MATCH_BY passed
	ErrBadMatchByType = errors.New("cert match by type not implemented")

	// ErrBadCertStore represents unknown CERT_STORE passed
	ErrBadCertStore = errors.New("cert store type not implemented")

	// ErrConflictCertFileAndStore represents ambiguous configuration of both file and store
	ErrConflictCertFileAndStore = errors.New("'cert_file' and 'cert_store' may not both be configured")

	// ErrBadCertStoreField represents malformed cert_store option
	ErrBadCertStoreField = errors.New("expected 'cert_store' to be a valid non-empty string")

	// ErrBadCertMatchByField represents malformed cert_match_by option
	ErrBadCertMatchByField = errors.New("expected 'cert_match_by' to be a valid non-empty string")

	// ErrBadCertMatchField represents malformed cert_match option
	ErrBadCertMatchField = errors.New("expected 'cert_match' to be a valid non-empty string")

	// ErrBadCaCertMatchField represents malformed cert_match option
	ErrBadCaCertMatchField = errors.New("expected 'ca_certs_match' to be a valid non-empty string array")

	// ErrBadCertMatchSkipInvalidField represents malformed cert_match_skip_invalid option
	ErrBadCertMatchSkipInvalidField = errors.New("expected 'cert_match_skip_invalid' to be a boolean")

	// ErrOSNotCompatCertStore represents cert_store passed that exists but is not valid on current OS
	ErrOSNotCompatCertStore = errors.New("cert_store not compatible with current operating system")
)

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Ensure cert_store is a quoted, non-empty string, e.g. cert_store: "LocalMachine\\My".
2. If using environment variables ($CERT_STORE), verify the variable is set and non-empty in the server's environment.
3. Quote the value in YAML/JSON so it is not parsed as another type.
4. Run the config through `nats-server --signal reload` or `nats-server -t` style validation to catch the bad token before startup.

Example fix

// before
cert_store: ${CERT_STORE}   # unset env => empty
// after (yaml)
cert_store: "LocalMachine\\My"

if s, ok := cfg.TLS.CertStore.(string); !ok || s == "" {
    return errors.New("cert_store must be a non-empty string")
}

func isBadCertStoreField(err error) bool { return errors.Is(err, certstore.ErrBadCertStoreField) }

if ce, ok := err.(*server.configErr); ok && strings.Contains(ce.Error(), "cert_store") {
    // fix the token/line reported by configErr
}

When it happens

Trigger: server/opts.go:5274 — parsing a TLS config map: the cert_store value is not a Go string (e.g. a number/bool) or is _EMPTY_, so the validator returns &configErr{tk, certstore.ErrBadCertStoreField.Error()} before ParseCertStore is ever called.

Common situations: YAML unquoted values interpreted as non-strings, env-var substitution leaving the value empty, or a copy/paste that dropped the store path entirely.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• expected 'cert_match_by' to be a valid non-empty string
• expected 'cert_match' to be a valid non-empty string
• 'cert_file' and 'cert_store' may not both be configured
• invalid chain link
• ErrBadCryptoStoreProvider

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/df112387f4dbfb9f. Report an issue: GitHub.