{"record":{"id":"777cf0feaaf6db6f","repo":"nats-io/nats-server","slug":"errnoprivatekeystoreref","errorCode":"ErrNoPrivateKeyStoreRef","errorMessage":"unable to obtain private key handle from store","messagePattern":"unable to obtain private key handle from store","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certstore/errors.go","lineNumber":24,"sourceCode":"\nvar (\n\t// ErrBadCryptoStoreProvider represents inablity to establish link with a certificate store\n\tErrBadCryptoStoreProvider = errors.New(\"unable to open certificate store or store not available\")\n\n\t// ErrBadRSAHashAlgorithm represents a bad or unsupported RSA hash algorithm\n\tErrBadRSAHashAlgorithm = errors.New(\"unsupported RSA hash algorithm\")\n\n\t// ErrBadSigningAlgorithm represents a bad or unsupported signing algorithm\n\tErrBadSigningAlgorithm = errors.New(\"unsupported signing algorithm\")\n\n\t// ErrStoreRSASigningError represents an error returned from store during RSA signature\n\tErrStoreRSASigningError = errors.New(\"unable to obtain RSA signature from store\")\n\n\t// ErrStoreECDSASigningError represents an error returned from store during ECDSA signature\n\tErrStoreECDSASigningError = errors.New(\"unable to obtain ECDSA signature from store\")\n\n\t// ErrNoPrivateKeyStoreRef represents an error getting a handle to a private key in store\n\tErrNoPrivateKeyStoreRef = errors.New(\"unable to obtain private key handle from store\")\n\n\t// ErrExtractingPrivateKeyMetadata represents a family of errors extracting metadata about the private key in store\n\tErrExtractingPrivateKeyMetadata = errors.New(\"unable to extract private key metadata\")\n\n\t// ErrExtractingECCPublicKey represents an error exporting ECC-type public key from store\n\tErrExtractingECCPublicKey = errors.New(\"unable to extract ECC public key from store\")\n\n\t// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store\n\tErrExtractingRSAPublicKey = errors.New(\"unable to extract RSA public key from store\")\n\n\t// ErrExtractingPublicKey represents a general error exporting public key from store\n\tErrExtractingPublicKey = errors.New(\"unable to extract public key from store\")\n\n\t// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm\n\tErrBadPublicKeyAlgorithm = errors.New(\"unsupported public key algorithm\")\n\n\t// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field\n\tErrExtractPropertyFromKey = errors.New(\"unable to extract property from key\")","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/errors.go#L6-L42","documentation":"ErrNoPrivateKeyStoreRef is returned when the library cannot obtain a handle to the certificate's private key in the Windows store. At certstore_windows.go:249 it is returned from the TLSConfig build path when the acquired private key object is nil; at :717 it is returned when CryptAcquireCertificatePrivateKey (or the equivalent NCrypt call) returns 0/failure. This means the certificate exists but no usable private key reference could be obtained.","triggerScenarios":"Building a tls.Config via the certstore TLSConfig API on Windows with a certificate that has no linked private key (pk == nil at :249), or CryptAcquireCertificatePrivateKey failing at :717 for a cert whose key lives in an inaccessible store.","commonSituations":"Importing a .cer file (public part only) without its private key; certificate located in a store the process cannot read (wrong user vs machine store, missing admin rights); smart-card cert whose card is absent; key deleted or migrated after certificate issuance.","solutions":["Verify the certificate has an associated private key (certmgr.msc shows a key icon / 'You have a private key that corresponds to this certificate').","Target the correct store (CurrentUser vs LocalMachine) and run with sufficient privileges to read the key.","Re-import the certificate together with its PFX/private key, or insert the smart card holding the key.","Check that the key's KSP is registered and accessible (certutil -repairstore can repair broken key associations)."],"exampleFix":"// before: importing only the public certificate\n// certutil -addstore My server.cer        -> ErrNoPrivateKeyStoreRef\n// after: import cert + key\n// certutil -importpfx -user My server.pfx","handlingStrategy":"validation","validationCode":"// before building TLS config, verify the cert has an accessible private key\nif !hasPrivateKey(cert) { // e.g. via store enumeration / key prov info\n    return fmt.Errorf(\"certificate %s has no accessible private key\", cert.Subject)\n}","typeGuard":"func hasStorePrivateKey(cert *x509.Certificate) bool {\n    // probe: acquire handle; nil or error means no usable key ref\n    pk, err := acquirePrivateKey(cert)\n    return err == nil && pk != nil\n}","tryCatchPattern":"tlsCfg, err := certstore.TLSConfig(cert)\nif errors.Is(err, certstore.ErrNoPrivateKeyStoreRef) {\n    return fmt.Errorf(\"install the certificate WITH its private key (import PFX, insert smart card): %w\", err)\n}","preventionTips":["Import PFX files (cert + key), not bare .cer files.","Pick the right store (CurrentUser vs LocalMachine) and run with required privileges.","Verify with certmgr.msc or `certutil -store My` that the key icon/association exists.","Use `certutil -repairstore` when the key association is broken."],"tags":["windows","certificate-store","private-key","ncrypt"],"backgroundTag":"missing-private-key","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}