nats-io/nats-server · error

unable to match any CA certificate: %v

Error message

unable to match any CA certificate: %v

What it means

Windows cert store pool creation: none of the subject-match strings in caCertsMatch yielded a usable certificate from the CA store (each lookup failed or matched nothing), so an empty CA pool cannot be built.

Source

Thrown at server/certstore/certstore_windows.go:188

// adding all matching certificates from the caCertsMatch array to the pool.
// All matching certificates (vs first) are added to the pool based on a user
// request. If no certificates are found an error is returned.
func createCACertsPool(cs *winCertStore, storeType uint32, caCertsMatch []string, skipInvalid bool) (*x509.CertPool, error) {
	var errs []error
	caPool := x509.NewCertPool()
	for _, s := range caCertsMatch {
		lfs, err := cs.caCertsBySubjectMatch(s, storeType, skipInvalid)
		if err != nil {
			errs = append(errs, err)
		} else {
			for _, lf := range lfs {
				caPool.AddCert(lf)
			}
		}
	}
	// If every lookup failed return the errors.
	if len(errs) == len(caCertsMatch) {
		return nil, fmt.Errorf("unable to match any CA certificate: %v", errs)
	}
	return caPool, nil
}

// TLSConfig fulfills the same function as reading cert and key pair from
// pem files but sources the Windows certificate store instead. The
// certMatchBy and certMatch fields search the "MY" certificate location
// for the first certificate that matches the certMatch field. The
// caCertsMatch field is used to search the Trusted Root, Third Party Root,
// and Intermediate Certificate Authority locations for certificates with
// Subjects matching the provided strings. If a match is found, the
// certificate is added to the pool that is used to verify the certificate
// chain.
func TLSConfig(certStore StoreType, certMatchBy MatchByType, certMatch string, caCertsMatch []string, skipInvalid bool, config *tls.Config) error {
	var (
		leaf     *x509.Certificate
		leafCtx  *windows.CertContext
		pk       *winKey

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Verify the CA certificate subjects configured for matching exist in the Windows store
2. Import the required CA certificates into the system store
3. Adjust caCertsMatch patterns to match actual certificate subjects

When it happens

Trigger: Thrown at server/certstore/certstore_windows.go:188 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/ebbb8f5ab19d266e. Report an issue: GitHub.