{"record":{"id":"4bfb359119e6e18e","repo":"nats-io/nats-server","slug":"unable-to-generate-new-key-from-the-tpm-v","errorCode":null,"errorMessage":"unable to generate new key from the TPM: %v","messagePattern":"unable to generate new key from the TPM: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/tpm/js_ek_tpm_windows.go","lineNumber":267,"sourceCode":"\t}\n\tdefer rwc.Close()\n\n\t// Load the key from the TPM\n\tsrkHandle, err := regenerateSRK(rwc, srkPassword)\n\tdefer func() {\n\t\ttpm2.FlushContext(rwc, srkHandle)\n\t}()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"unable to regenerate SRK from the TPM: %v\", err)\n\t}\n\t// Read the keys from the key file. If the filed doesn't exist it means we need to create\n\t// a new js encrytpion key.\n\tpublicBlob, privateBlob, err := readTPMKeysFromFile(jsKeyFile)\n\tif err != nil {\n\t\tif os.IsNotExist(err) {\n\t\t\tjsek, err := createAndSealJsEncryptionKey(rwc, srkHandle, srkPassword, jsKeyFile, jsKeyPassword, pcr)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", fmt.Errorf(\"unable to generate new key from the TPM: %v\", err)\n\t\t\t}\n\t\t\t// we've created and sealed the JS Encryption key, now we just return it.\n\t\t\treturn jsek, nil\n\t\t}\n\t\treturn \"\", fmt.Errorf(\"unable to load key from TPM: %v\", err)\n\t}\n\n\t// Unseal the JetStream encryption key using the TPM.\n\tjsek, err := unsealJsEncrpytionKey(rwc, pcr, srkHandle, srkPassword, jsKeyPassword, publicBlob, privateBlob)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"unable to unseal key from the TPM: %v\", err)\n\t}\n\treturn jsek, nil\n}\n","sourceCodeStart":249,"sourceCodeEnd":282,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/tpm/js_ek_tpm_windows.go#L249-L282","documentation":"Wraps an error from createAndSealJsEncryptionKey() in LoadJetStreamEncryptionKeyFromTPM. Reached when the JetStream key file does not exist and a new key must be created and sealed against the SRK; it fires if key generation, sealing, or writing the public/private blobs to jsKeyFile fails.","triggerScenarios":"Thrown at server/tpm/js_ek_tpm_windows.go:267 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check disk permissions and space for the directory containing jsKeyFile","Verify the TPM can perform key creation and sealing operations","Confirm srkHandle and srkPassword are valid for sealing","Delete any partially written key file and retry creation"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}