Stalwart-cli cannot apply its own Certificate output due to missing matchOn property subjectAlternativeNames

Issues
1

Issue Description

I’ve observed a weird behaviour:

stalwart-cli  snapshot Certificate  | stalwart-cli apply --stdin
snapshot: 1 upserts, 0 singletons
  fetching Certificate...
    7 fetched
    Certificate: 7
snapshot complete
Plan: 0 destroy, 0 update, 0 create, 1 upsert (7 objects)
✗ upsert Certificate: Certificate: match property `subjectAlternativeNames` is missing from the object body
Done: 0 destroyed, 0 updated, 0 created (1 failed)
error: Certificate: match property `subjectAlternativeNames` is missing from the object body

stalwart-cli snapshot Certificate yields:

{
  "@type": "upsert",
  "object": "Certificate",
  "matchOn": [
    "subjectAlternativeNames"
  ],
  "value": {
    "certificate-iyt0es3kakaa": {
      "privateKey": {
        "@type": "File",
        "filePath": "/etc/stalwart/certs/domain1.key"
      },
      "certificate": {
        "@type": "File",
        "filePath": "/etc/stalwart/certs/domain1.crt"
      }
    },
    "certificate-iyt0elckajqa": {
      "privateKey": {
        "@type": "File",
        "filePath": "/etc/stalwart/certs/domain2.key"
      },
      "certificate": {
        "@type": "File",
        "filePath": "/etc/stalwart/certs/domain2.crt"
      }
    }
  }
}

stalwart-cli apply fails:

Plan: 0 destroy, 0 update, 0 create, 1 upsert (2 objects)
✗ upsert Certificate: Certificate: match property `subjectAlternativeNames` is missing from the object body
Done: 0 destroyed, 0 updated, 0 created (1 failed)
error: Certificate: match property `subjectAlternativeNames` is missing from the object body

Stalwart Version

v0.16.x

Installation Method

Built from source

Database Backend

RocksDB

Blob Storage

RocksDB

Search Engine

Internal

Directory Backend

Internal

I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.

on

I have searched this support forum (open and closed topics) and confirm this is not a duplicate.

on

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

Let me look into this issue by examining the CLI source code for how snapshot and apply handle Certificates and the matchOn / subjectAlternativeNames logic.

This is a confirmed bug that has already been fixed in the stalwart-cli codebase.

The snapshot command was generating upsert blocks with matchOn: ["subjectAlternativeNames"], but the apply command then expected to find a subjectAlternativeNames field inside each certificate’s object body – which is not present in the snapshot output. This caused the “match property subjectAlternativeNames is missing from the object body” error.

The fix is recorded in the CLI changelog as:

[1.0.10] - 2026-06-25
Fixed: upsert removed required matchOn field.

You need to update stalwart-cli to version 1.0.10 or later. Since you built from source, pull the latest commits from the stalwart-cli repository and rebuild.

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

Hm. 1.0.10 has not been tagged yet Tags · stalwartlabs/cli · GitHub let alone released (not linking to the releases page as disqus doesn’t let me)

It’ll be interesting to see whether that commit `upsert` removed required `matchOn` field · stalwartlabs/cli@2335a98 · GitHub fixes it. I have my doubts we let me try once it has been released.

4

We were waiting for feedback from the original reporter but it’s been a while now so v1.0.10 has been just released.

5

It works :slight_smile:

```
stalwart-cli snapshot Certificate | stalwart-cli apply --stdin
snapshot: 1 upserts, 0 singletons
fetching Certificate…
7 fetched
Certificate: 7
snapshot complete
Plan: 0 destroy, 0 update, 0 create, 1 upsert (7 objects)
✓ upserted Certificate (7)
Done: 0 destroyed, 7 updated, 0 created (0 failed)
```

Although I think that it shouldn’t have updated anything. But it gets the job done.
Thanks!