nats-io/nats-server · error

unable to extract x509 from certificate

Error message

unable to extract x509 from certificate

What it means

ErrFailedX509Extract is returned when the store found a certificate context but could not convert it into a Go x509.Certificate. certSearch returns it when CertCreateCertificateContext or x509 parsing of the encoded cert blob fails, or when no certificate context survived the search.

Source

Thrown at server/certstore/errors.go:51

	ErrExtractingRSAPublicKey = errors.New("unable to extract RSA public key from store")

	// ErrExtractingPublicKey represents a general error exporting public key from store
	ErrExtractingPublicKey = errors.New("unable to extract public key from store")

	// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm
	ErrBadPublicKeyAlgorithm = errors.New("unsupported public key algorithm")

	// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field
	ErrExtractPropertyFromKey = errors.New("unable to extract property from key")

	// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported
	ErrBadECCCurveName = errors.New("unsupported ECC curve name")

	// ErrFailedCertSearch represents not able to find certificate in store
	ErrFailedCertSearch = errors.New("unable to find certificate in store")

	// ErrFailedX509Extract represents not being able to extract x509 certificate from found cert in store
	ErrFailedX509Extract = errors.New("unable to extract x509 from certificate")

	// ErrBadMatchByType represents unknown CERT_MATCH_BY passed
	ErrBadMatchByType = errors.New("cert match by type not implemented")

	// ErrBadCertStore represents unknown CERT_STORE passed
	ErrBadCertStore = errors.New("cert store type not implemented")

	// ErrConflictCertFileAndStore represents ambiguous configuration of both file and store
	ErrConflictCertFileAndStore = errors.New("'cert_file' and 'cert_store' may not both be configured")

	// ErrBadCertStoreField represents malformed cert_store option
	ErrBadCertStoreField = errors.New("expected 'cert_store' to be a valid non-empty string")

	// ErrBadCertMatchByField represents malformed cert_match_by option
	ErrBadCertMatchByField = errors.New("expected 'cert_match_by' to be a valid non-empty string")

	// ErrBadCertMatchField represents malformed cert_match option
	ErrBadCertMatchField = errors.New("expected 'cert_match' to be a valid non-empty string")

View on GitHub (pinned to 3a66a489d2)

Solutions

  1. Remove and re-import the offending certificate into the store to eliminate a corrupted entry.
  2. Inspect the cert with `certutil -v -store My <thumbprint>`; re-export to DER/PEM and test `openssl x509 -inform der -in cert.der` to see whether the encoding parses.
  3. Skip invalid certs by enabling cert_match_skip_invalid so a single bad entry does not abort the search.
  4. If Go rejects a valid cert extension, update the library/Go version for newer x509 parsing fixes, or reissue the cert without the problematic extension.

Example fix

// before: bad store entry aborts everything
cert_match_skip_invalid: false
// after
cert_match_skip_invalid: true
Defensive patterns

Strategy: try-catch

Validate before calling

// Enable skip_invalid so one corrupt entry cannot abort the search
tls {
  cert_match_skip_invalid: true
}

Type guard

func isX509ExtractErr(err error) bool { return errors.Is(err, certstore.ErrFailedX509Extract) }

Try / catch

tc, err := cs.TLSConfig()
if errors.Is(err, certstore.ErrFailedX509Extract) {
    // identify corrupt store entry, re-import cert
}

Prevention

When it happens

Trigger: certstore_windows.go:491 returns it when x509.ParseCertificate fails on the CryptoAPI-derived DER bytes; :499 returns it when the final cert handle is nil after the search loop.

Common situations: Corrupted certificate entries in the Windows store, certificates with malformed extensions Go's parser rejects, or store entries pointing at deleted/invalid contexts.

Understand the failure class

Related errors

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/b9987f40a38b648f. Report an issue: GitHub.