{"record":{"id":"1f6f1236d8f9a2a4","repo":"nats-io/nats-server","slug":"unable-to-load-key-from-tpm-v","errorCode":null,"errorMessage":"unable to load key from TPM: %v","messagePattern":"unable to load key from TPM: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/tpm/js_ek_tpm_windows.go","lineNumber":272,"sourceCode":"\tdefer func() {\n\t\ttpm2.FlushContext(rwc, srkHandle)\n\t}()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"unable to regenerate SRK from the TPM: %v\", err)\n\t}\n\t// Read the keys from the key file. If the filed doesn't exist it means we need to create\n\t// a new js encrytpion key.\n\tpublicBlob, privateBlob, err := readTPMKeysFromFile(jsKeyFile)\n\tif err != nil {\n\t\tif os.IsNotExist(err) {\n\t\t\tjsek, err := createAndSealJsEncryptionKey(rwc, srkHandle, srkPassword, jsKeyFile, jsKeyPassword, pcr)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", fmt.Errorf(\"unable to generate new key from the TPM: %v\", err)\n\t\t\t}\n\t\t\t// we've created and sealed the JS Encryption key, now we just return it.\n\t\t\treturn jsek, nil\n\t\t}\n\t\treturn \"\", fmt.Errorf(\"unable to load key from TPM: %v\", err)\n\t}\n\n\t// Unseal the JetStream encryption key using the TPM.\n\tjsek, err := unsealJsEncrpytionKey(rwc, pcr, srkHandle, srkPassword, jsKeyPassword, publicBlob, privateBlob)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"unable to unseal key from the TPM: %v\", err)\n\t}\n\treturn jsek, nil\n}\n","sourceCodeStart":254,"sourceCodeEnd":282,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/tpm/js_ek_tpm_windows.go#L254-L282","documentation":"Wraps an error from readTPMKeysFromFile() in LoadJetStreamEncryptionKeyFromTPM. It fires when the JetStream key file exists but cannot be read or its public/private blobs cannot be parsed (corrupt, truncated, or permission-denied file), so the sealed key cannot be loaded for unsealing.","triggerScenarios":"Thrown at server/tpm/js_ek_tpm_windows.go:272 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check permissions on jsKeyFile and its containing directory","If the file is corrupt, remove it so a fresh key is created and sealed on the next call","Verify the file was not truncated or modified since it was written","Recreate the JetStream encryption key if blobs cannot be recovered"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}