{"record":{"id":"7436e18026850ca0","repo":"nats-io/nats-server","slug":"unable-to-get-policy-v","errorCode":null,"errorMessage":"unable to get policy: %v","messagePattern":"unable to get policy: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/tpm/js_ek_tpm_windows.go","lineNumber":150,"sourceCode":"func createAndSealJsEncryptionKey(rwc io.ReadWriteCloser, srkHandle tpmutil.Handle, srkPassword, jsKeyFile, jsKeyPassword string, pcr int) (string, error) {\n\t// Get the authorization policy that will protect the data to be sealed\n\tsessHandle, policy, err := policyPCRPasswordSession(rwc, pcr)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"unable to get policy: %v\", err)\n\t}\n\tif err := tpm2.FlushContext(rwc, sessHandle); err != nil {\n\t\treturn \"\", fmt.Errorf(\"unable to flush session: %v\", err)\n\t}\n\t// Seal the data to the parent key and the policy\n\tuser, err := nkeys.CreateUser()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"unable to create seed: %v\", err)\n\t}\n\tjsStoreKey, err := user.Seed()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"unable to get seed: %v\", err)\n\t}\n\tprivateArea, publicArea, err := tpm2.Seal(rwc, srkHandle, srkPassword, jsKeyPassword, policy, jsStoreKey)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"unable to seal data: %v\", err)\n\t}\n\treturn string(jsStoreKey), nil\n}","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/tpm/js_ek_tpm_windows.go#L132-L168","documentation":"policyPCRPasswordSession failed while createAndSealJsEncryptionKey was setting up the authorization policy for sealing a new JetStream key. The TPM rejected one of the policy session steps (StartAuthSession, PolicyPCR, PolicyPassword, or PolicyGetDigest), so no new key can be sealed — typically a TPM device error, unsupported algorithm, or bad PCR index.","triggerScenarios":"Thrown at server/tpm/js_ek_tpm_windows.go:150 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the wrapped error from policyPCRPasswordSession to identify the failing TPM command","Verify the configured PCR index is valid (0-23) for the SHA-256 bank","Confirm the TPM device is healthy and responsive (e.g. tpm2_getcap)","Retry after resolving the TPM error; the key creation will be attempted again on next start"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}