{"record":{"id":"02e9ec015723c1ba","repo":"nats-io/nats-server","slug":"errbadcryptostoreprovider","errorCode":"ErrBadCryptoStoreProvider","errorMessage":"unable to open certificate store or store not available","messagePattern":"unable to open certificate store or store not available","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"server/certstore/errors.go","lineNumber":9,"sourceCode":"package certstore\n\nimport (\n\t\"errors\"\n)\n\nvar (\n\t// ErrBadCryptoStoreProvider represents inablity to establish link with a certificate store\n\tErrBadCryptoStoreProvider = errors.New(\"unable to open certificate store or store not available\")\n\n\t// ErrBadRSAHashAlgorithm represents a bad or unsupported RSA hash algorithm\n\tErrBadRSAHashAlgorithm = errors.New(\"unsupported RSA hash algorithm\")\n\n\t// ErrBadSigningAlgorithm represents a bad or unsupported signing algorithm\n\tErrBadSigningAlgorithm = errors.New(\"unsupported signing algorithm\")\n\n\t// ErrStoreRSASigningError represents an error returned from store during RSA signature\n\tErrStoreRSASigningError = errors.New(\"unable to obtain RSA signature from store\")\n\n\t// ErrStoreECDSASigningError represents an error returned from store during ECDSA signature\n\tErrStoreECDSASigningError = errors.New(\"unable to obtain ECDSA signature from store\")\n\n\t// ErrNoPrivateKeyStoreRef represents an error getting a handle to a private key in store\n\tErrNoPrivateKeyStoreRef = errors.New(\"unable to obtain private key handle from store\")\n\n\t// ErrExtractingPrivateKeyMetadata represents a family of errors extracting metadata about the private key in store\n\tErrExtractingPrivateKeyMetadata = errors.New(\"unable to extract private key metadata\")","sourceCodeStart":1,"sourceCodeEnd":27,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/errors.go#L1-L27","documentation":"ErrBadCryptoStoreProvider indicates the library could not establish a link to a certificate store on the platform. On Windows, winNewStoreHandle fails when the crypto API (CertOpenStore) cannot open the requested store, and store-counting code also surfaces this error when a store handle cannot be created for the given provider.","triggerScenarios":"Calling certstore APIs with an invalid/unsupported provider or store name so CertOpenStore fails; requesting a system store that does not exist or is inaccessible.","commonSituations":"Windows environments where the certificate store name is misspelled, permissions block store access (e.g. service accounts lacking access to CURRENT_USER stores), or non-Windows builds misusing the Windows provider path.","solutions":["Verify the store name and provider constants passed to certstore (e.g. 'MY', 'Root') are valid Windows store names","Run under an account with permission to open the target certificate store (check CURRENT_USER vs LOCAL_MACHINE scope)","Import the certificate into the store you are referencing (certmgr.msc / certlm.msc)","If using crypto store providers (e.g. TPM/KSP), confirm the provider is installed and functional on the machine"],"exampleFix":"// before\nstore, err := certstore.OpenStore(\"Personal\") // not a system store name\n// after\nstore, err := certstore.OpenStore(certstore.StoreNameMy) // 'MY' system store","handlingStrategy":"validation","validationCode":"// verify the store can be opened before use\nif _, err := certstore.OpenStore(certstore.StoreNameMy); err != nil {\n    return fmt.Errorf(\"certificate store unavailable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"stores, err := certstore.OpenStores(provider)\nif errors.Is(err, certstore.ErrBadCryptoStoreProvider) {\n    return fmt.Errorf(\"cannot open certificate store %q: check name/permissions: %w\", storeName, err)\n}","preventionTips":["Use standard Windows system store names (MY, Root, CA)","Run the service under an account with access to the target store","Confirm certificates are actually imported into the referenced store","Test store access on the target machine before deployment"],"tags":["windows","certificates","certstore","crypto","configuration"],"backgroundTag":"certificate-store-unavailable","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}