nats-io/nats-server · error

TLS Server certificate must be present and valid

Error message

TLS Server certificate must be present and valid

What it means

overrideTLS runs because -tls=true was set (tlsOverride) but opts.TLSCert is empty — TLS cannot be configured without a server certificate. The missing TLSCert option (e.g. --tlscert / cert_file) is the input at fault.

Source

Thrown at server/opts.go:6490

	return opts, nil
}

func normalizeBasePath(p string) string {
	if len(p) == 0 {
		return "/"
	}
	// add leading slash
	if p[0] != '/' {
		p = "/" + p
	}
	return path.Clean(p)
}

// overrideTLS is called when at least "-tls=true" has been set.
func overrideTLS(opts *Options) error {
	if opts.TLSCert == _EMPTY_ {
		return errors.New("TLS Server certificate must be present and valid")
	}
	if opts.TLSKey == _EMPTY_ {
		return errors.New("TLS Server private key must be present and valid")
	}

	tc := TLSConfigOpts{}
	tc.CertFile = opts.TLSCert
	tc.KeyFile = opts.TLSKey
	tc.CaFile = opts.TLSCaCert
	tc.Verify = opts.TLSVerify
	tc.Ciphers = defaultCipherSuites()

	var err error
	opts.TLSConfig, err = GenTLSConfig(&tc)
	return err
}

// overrideCluster updates Options.Cluster if that flag "cluster" (or "cluster_listen")

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Supply the server certificate, e.g. --tlscert server.pem
2. Configure cert_file/key_file in the TLS block instead of the -tls override
3. Drop -tls=true if TLS was not intended

When it happens

Trigger: Thrown at server/opts.go:6490 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/bb2130c603c60707. Report an issue: GitHub.