{"record":{"id":"551899252d229343","repo":"nats-io/nats-server","slug":"unable-to-unseal-key-from-the-tpm-v","errorCode":null,"errorMessage":"unable to unseal key from the TPM: %v","messagePattern":"unable to unseal key from the TPM: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/tpm/js_ek_tpm_windows.go","lineNumber":278,"sourceCode":"\t// Read the keys from the key file. If the filed doesn't exist it means we need to create\n\t// a new js encrytpion key.\n\tpublicBlob, privateBlob, err := readTPMKeysFromFile(jsKeyFile)\n\tif err != nil {\n\t\tif os.IsNotExist(err) {\n\t\t\tjsek, err := createAndSealJsEncryptionKey(rwc, srkHandle, srkPassword, jsKeyFile, jsKeyPassword, pcr)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", fmt.Errorf(\"unable to generate new key from the TPM: %v\", err)\n\t\t\t}\n\t\t\t// we've created and sealed the JS Encryption key, now we just return it.\n\t\t\treturn jsek, nil\n\t\t}\n\t\treturn \"\", fmt.Errorf(\"unable to load key from TPM: %v\", err)\n\t}\n\n\t// Unseal the JetStream encryption key using the TPM.\n\tjsek, err := unsealJsEncrpytionKey(rwc, pcr, srkHandle, srkPassword, jsKeyPassword, publicBlob, privateBlob)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"unable to unseal key from the TPM: %v\", err)\n\t}\n\treturn jsek, nil\n}\n","sourceCodeStart":260,"sourceCodeEnd":282,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/tpm/js_ek_tpm_windows.go#L260-L282","documentation":"Wraps an error from unsealing the JetStream encryption key inside LoadJetStreamEncryptionKeyFromTPM. It fires when the TPM refuses to unseal the stored blobs, most often because jsKeyPassword or the PCR value does not match those used at seal time, or the sealed object is corrupt.","triggerScenarios":"Thrown at server/tpm/js_ek_tpm_windows.go:278 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify jsKeyPassword matches the password used when the key was sealed","Confirm the PCR value has not changed since sealing (e.g. after firmware or boot-chain updates)","If PCR policy changed, re-seal the key under the new PCR value","If blobs are corrupt, delete jsKeyFile and create a new sealed key"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}