{"record":{"id":"4363a610a6c56ad6","repo":"nats-io/nats-server","slug":"errstorersasigningerror","errorCode":"ErrStoreRSASigningError","errorMessage":"unable to obtain RSA signature from store","messagePattern":"unable to obtain RSA signature from store","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certstore/errors.go","lineNumber":18,"sourceCode":"package certstore\n\nimport (\n\t\"errors\"\n)\n\nvar (\n\t// ErrBadCryptoStoreProvider represents inablity to establish link with a certificate store\n\tErrBadCryptoStoreProvider = errors.New(\"unable to open certificate store or store not available\")\n\n\t// ErrBadRSAHashAlgorithm represents a bad or unsupported RSA hash algorithm\n\tErrBadRSAHashAlgorithm = errors.New(\"unsupported RSA hash algorithm\")\n\n\t// ErrBadSigningAlgorithm represents a bad or unsupported signing algorithm\n\tErrBadSigningAlgorithm = errors.New(\"unsupported signing algorithm\")\n\n\t// ErrStoreRSASigningError represents an error returned from store during RSA signature\n\tErrStoreRSASigningError = errors.New(\"unable to obtain RSA signature from store\")\n\n\t// ErrStoreECDSASigningError represents an error returned from store during ECDSA signature\n\tErrStoreECDSASigningError = errors.New(\"unable to obtain ECDSA signature from store\")\n\n\t// ErrNoPrivateKeyStoreRef represents an error getting a handle to a private key in store\n\tErrNoPrivateKeyStoreRef = errors.New(\"unable to obtain private key handle from store\")\n\n\t// ErrExtractingPrivateKeyMetadata represents a family of errors extracting metadata about the private key in store\n\tErrExtractingPrivateKeyMetadata = errors.New(\"unable to extract private key metadata\")\n\n\t// ErrExtractingECCPublicKey represents an error exporting ECC-type public key from store\n\tErrExtractingECCPublicKey = errors.New(\"unable to extract ECC public key from store\")\n\n\t// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store\n\tErrExtractingRSAPublicKey = errors.New(\"unable to extract RSA public key from store\")\n\n\t// ErrExtractingPublicKey represents a general error exporting public key from store\n\tErrExtractingPublicKey = errors.New(\"unable to extract public key from store\")","sourceCodeStart":1,"sourceCodeEnd":36,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/errors.go#L1-L36","documentation":"ErrStoreRSASigningError is returned when the Windows CNG call NCryptSignHash (with winBCryptPadPKCS1 padding) fails — the syscall returns a nonzero NTSTATUS/NTSTATUS-like result. The library asked the Windows certificate store / key storage provider to produce an RSA signature over a hash, and Windows refused. Unlike the Bad* errors, the hash algorithm and options were valid; the failure is inside the OS key operation.","triggerScenarios":"TLSConfig-configured store-backed RSA key signing via Sign -> NCryptSignHash returning r != 0 at certstore_windows.go:633 or :648 — i.e. the private key handle is stale/revoked, the key is non-exportable with disallowed usage, the smart card is removed, or PKCS1 padding is rejected by the KSP.","commonSituations":"Smart-card or TPM-based certificates where the card is removed or locked; certificate private keys with restricted key-usage (no digital signature); keys whose handles went stale after the store was reopened; HSM/KSP denying the operation for policy reasons.","solutions":["Re-open the certificate store and re-acquire the private key handle (handles can go stale), then retry the handshake.","Confirm the certificate's private key has the Digital Signature key usage and is accessible (certmgr.msc -> key is present, smart card inserted).","Check Windows Event Viewer / NCrypt error code returned by the underlying call for the specific KSP failure reason.","Test signing with a software-backed key to isolate whether the KSP/TPM/smart card is the problem."],"exampleFix":"// before: long-lived cached signer over a smart-card key that was re-inserted\nsig, err := cachedSigner.Sign(rand, digest, crypto.SHA256)\n// after: reacquire the key before signing\nstore, err := certstore.Open(...) // reopen and get a fresh TLSConfig/signer\nsig, err := freshSigner.Sign(rand, digest, crypto.SHA256)","handlingStrategy":"retry","validationCode":"// validate before handshake: key present and has digital-signature usage\nif key, err := certstore.AcquirePrivateKeyHandle(cert); err != nil || key == nil {\n    return fmt.Errorf(\"RSA key handle not usable: %v\", err)\n}","typeGuard":"func isStoreSigningError(err error) bool {\n    return errors.Is(err, certstore.ErrStoreRSASigningError) ||\n        errors.Is(err, certstore.ErrStoreECDSASigningError)\n}","tryCatchPattern":"sig, err := signer.Sign(rand, digest, crypto.SHA256)\nif errors.Is(err, certstore.ErrStoreRSASigningError) {\n    // reacquire handle and retry once\n    signer = reacquireSigner(cert)\n    sig, err = signer.Sign(rand, digest, crypto.SHA256)\n}","preventionTips":["Keep smart cards / TPM keys present and unlocked during operation.","Reopen the store and reacquire key handles rather than caching them for long periods.","Ensure the certificate's key usage includes Digital Signature.","Surface the underlying NCrypt status code in logs for diagnosis."],"tags":["windows","certificate-store","rsa","ncrypt","signing"],"backgroundTag":"windows-key-operation-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}