nats-io/nats-server · error

unable to find certificate in store

Error message

unable to find certificate in store

What it means

ErrFailedCertSearch means the Windows certificate store lookup found no usable certificate matching the configured store/cert_match criteria. It is returned by TLSConfig, winFindCert, caCertsBySubjectMatch and certSearch when the store enumerates to nothing usable, the leaf context is nil, or CryptoAPI reports CRYPT_E_NOT_FOUND.

Source

Thrown at server/certstore/errors.go:48

	ErrExtractingECCPublicKey = errors.New("unable to extract ECC public key from store")

	// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store
	ErrExtractingRSAPublicKey = errors.New("unable to extract RSA public key from store")

	// ErrExtractingPublicKey represents a general error exporting public key from store
	ErrExtractingPublicKey = errors.New("unable to extract public key from store")

	// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm
	ErrBadPublicKeyAlgorithm = errors.New("unsupported public key algorithm")

	// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field
	ErrExtractPropertyFromKey = errors.New("unable to extract property from key")

	// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported
	ErrBadECCCurveName = errors.New("unsupported ECC curve name")

	// ErrFailedCertSearch represents not able to find certificate in store
	ErrFailedCertSearch = errors.New("unable to find certificate in store")

	// ErrFailedX509Extract represents not being able to extract x509 certificate from found cert in store
	ErrFailedX509Extract = errors.New("unable to extract x509 from certificate")

	// ErrBadMatchByType represents unknown CERT_MATCH_BY passed
	ErrBadMatchByType = errors.New("cert match by type not implemented")

	// ErrBadCertStore represents unknown CERT_STORE passed
	ErrBadCertStore = errors.New("cert store type not implemented")

	// ErrConflictCertFileAndStore represents ambiguous configuration of both file and store
	ErrConflictCertFileAndStore = errors.New("'cert_file' and 'cert_store' may not both be configured")

	// ErrBadCertStoreField represents malformed cert_store option
	ErrBadCertStoreField = errors.New("expected 'cert_store' to be a valid non-empty string")

	// ErrBadCertMatchByField represents malformed cert_match_by option
	ErrBadCertMatchByField = errors.New("expected 'cert_match_by' to be a valid non-empty string")

View on GitHub (pinned to 3a66a489d2)

Solutions

  1. Verify the certificate exists where you point: run `certutil -store My` / `certlm.msc` and compare thumbprint/subject with your cert_match value (case/whitespace matters).
  2. Confirm the certstore option names the correct store (e.g. 'LocalMachine\My') for where the cert actually resides.
  3. If the server runs as a Windows service, import the cert into the machine store or the service account's store — CurrentUser stores are per-user.
  4. Check that the certificate is valid (not expired) and has a private key if used for the serving side.

Example fix

// before
cert_store: "CurrentUser\My"
cert_match: "AB12..."
// after (cert actually lives in machine store)
cert_store: "LocalMachine\My"
cert_match: "ab12..."  // thumbprint without spaces, correct case
Defensive patterns

Strategy: validation

Validate before calling

// Verify cert exists in the target store before configuring
// certutil -user -store My | findstr /i "<thumbprint>"
// certutil -store My | findstr /i "<thumbprint>"
out := exec.Command("certutil", "-store", "My").Run()
_ = out // ensure thumbprint appears for the chosen store

Type guard

func isCertNotFound(err error) bool { return errors.Is(err, certstore.ErrFailedCertSearch) }

Try / catch

tc, err := cs.TLSConfig()
if errors.Is(err, certstore.ErrFailedCertSearch) {
    // log store + match values, optionally fall back to cert_file
}

Prevention

When it happens

Trigger: cs.TLSConfig -> certSearch/winFindCert: certstore_windows.go:242 returns it when leaf or leafCtx is nil; :333 translates a syscall.Errno(winCryptENotFound) — and any other search error — into this sentinel.

Common situations: Typo in cert_match thumbprint/subject, certificate in the wrong store (CurrentUser vs LocalMachine, My vs Root), cert expired/removed, or running as a service account that cannot see the user's store.

Understand the failure class

Related errors

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/a0e54eefa742dd8f. Report an issue: GitHub.