{"record":{"id":"1c2718d04e3eb30b","repo":"nats-io/nats-server","slug":"ncryptopenstorageprovider-returned-x-v","errorCode":null,"errorMessage":"NCryptOpenStorageProvider returned %X: %v","messagePattern":"NCryptOpenStorageProvider returned %X: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certstore/certstore_windows.go","lineNumber":316,"sourceCode":"\n// winWide returns a pointer to uint16 representing the equivalent\n// to a Windows LPCWSTR.\nfunc winWide(s string) *uint16 {\n\tw := utf16.Encode([]rune(s))\n\tw = append(w, 0)\n\treturn &w[0]\n}\n\n// winOpenProvider gets a provider handle for subsequent calls\nfunc winOpenProvider(provider string) (uintptr, error) {\n\tvar hProv uintptr\n\tpname := winWide(provider)\n\t// Open the provider, the last parameter is not used\n\tr, _, err := winNCryptOpenStorageProvider.Call(uintptr(unsafe.Pointer(&hProv)), uintptr(unsafe.Pointer(pname)), 0)\n\tif r == 0 {\n\t\treturn hProv, nil\n\t}\n\treturn hProv, fmt.Errorf(\"NCryptOpenStorageProvider returned %X: %v\", r, err)\n}\n\n// winFindCert wraps the CertFindCertificateInStore library call. Note that any cert context passed\n// into prev will be freed. If no certificate was found, nil will be returned.\nfunc winFindCert(store windows.Handle, enc, findFlags, findType uint32, para *uint16, prev *windows.CertContext) (*windows.CertContext, error) {\n\th, _, err := winCertFindCertificateInStore.Call(\n\t\tuintptr(store),\n\t\tuintptr(enc),\n\t\tuintptr(findFlags),\n\t\tuintptr(findType),\n\t\tuintptr(unsafe.Pointer(para)),\n\t\tuintptr(unsafe.Pointer(prev)),\n\t)\n\tif h == 0 {\n\t\t// Actual error, or simply not found?\n\t\tif errno, ok := err.(syscall.Errno); ok && errno == syscall.Errno(winCryptENotFound) {\n\t\t\treturn nil, ErrFailedCertSearch\n\t\t}","sourceCodeStart":298,"sourceCodeEnd":334,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/certstore_windows.go#L298-L334","documentation":"NCryptOpenStorageProvider failed to open the requested Windows key storage provider (e.g. the CNG 'Microsoft Software Key Storage Provider' or a TPM/smartcard provider). The NATS server calls NCryptOpenStorageProvider via syscall when opening the certificate store for TLS client-cert auth; the returned NTSTATUS (r) and the Go syscall error are wrapped into this message. Without a provider handle the server cannot enumerate certificates, so key-store-backed TLS identity setup fails.","triggerScenarios":"Calling winOpenProvider (via winOpenCertStore during NATS startup with a certstore-based TLS config on Windows) when: the provider name string is misspelled or not installed, the key store service is unavailable, or NCryptOpenStorageProvider returns a nonzero NTSTATUS (e.g. NTE_BAD_KEYSET 0x80090016, NTE_PROV_TYPE_NOT_DEF).","commonSituations":"Windows machine with corrupted or missing key containers; requesting a TPM or smartcard provider whose driver/service is not running; running as a service account without access to the user key store; typo in the configured provider name.","solutions":["Check the %X NTSTATUS in the message and look it up (e.g. 0x80090016 = NTE_BAD_KEYSET: keyset does not exist).","Verify the provider name in your TLS config matches an installed provider (certutil -csplist or ncrypt providers list).","Ensure the account running the NATS server (LocalSystem/service account) has access to the required key store; key stores are per-user.","If the keyset is corrupt, recreate the certificate/key pair or import the PFX into the target store with certlm.msc/certutil.","Ensure required services (TPM service, smartcard service) are running when using hardware providers."],"exampleFix":"// before\nopts.TLSConfig.CertStore = \"Microsoft Sofware Key Storage Provider\" // typo\n// after\nopts.TLSConfig.CertStore = \"Microsoft Software Key Storage Provider\"","handlingStrategy":"fallback","validationCode":"// PowerShell: verify the provider exists before configuring the server\ncertutil -csplist | Select-String \"Provider Name\"","typeGuard":null,"tryCatchPattern":"if err := server.Start(); err != nil && strings.Contains(err.Error(), \"NCryptOpenStorageProvider\") {\n    // parse NTSTATUS %X, log actionable message, and fall back to a PEM-file TLS config\n    log.Fatalf(\"key store unavailable (%v); use cert_file/key_file instead\", err)\n}","preventionTips":["Run certutil -csplist to confirm the provider name before configuring it.","Give the service account access to the key store or use machine store certificates.","Keep TLS config with PEM file fallback so server can start without the CNG provider.","Check TPM/smartcard service health on hosts using hardware providers."],"tags":["windows","tls","cng","keystore"],"backgroundTag":"cng-provider-open-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}