{"record":{"id":"982205289d4d5792","repo":"nats-io/nats-server","slug":"errextractingrsapublickey","errorCode":"ErrExtractingRSAPublicKey","errorMessage":"unable to extract RSA public key from store","messagePattern":"unable to extract RSA public key from store","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certstore/errors.go","lineNumber":33,"sourceCode":"\tErrBadSigningAlgorithm = errors.New(\"unsupported signing algorithm\")\n\n\t// ErrStoreRSASigningError represents an error returned from store during RSA signature\n\tErrStoreRSASigningError = errors.New(\"unable to obtain RSA signature from store\")\n\n\t// ErrStoreECDSASigningError represents an error returned from store during ECDSA signature\n\tErrStoreECDSASigningError = errors.New(\"unable to obtain ECDSA signature from store\")\n\n\t// ErrNoPrivateKeyStoreRef represents an error getting a handle to a private key in store\n\tErrNoPrivateKeyStoreRef = errors.New(\"unable to obtain private key handle from store\")\n\n\t// ErrExtractingPrivateKeyMetadata represents a family of errors extracting metadata about the private key in store\n\tErrExtractingPrivateKeyMetadata = errors.New(\"unable to extract private key metadata\")\n\n\t// ErrExtractingECCPublicKey represents an error exporting ECC-type public key from store\n\tErrExtractingECCPublicKey = errors.New(\"unable to extract ECC public key from store\")\n\n\t// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store\n\tErrExtractingRSAPublicKey = errors.New(\"unable to extract RSA public key from store\")\n\n\t// ErrExtractingPublicKey represents a general error exporting public key from store\n\tErrExtractingPublicKey = errors.New(\"unable to extract public key from store\")\n\n\t// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm\n\tErrBadPublicKeyAlgorithm = errors.New(\"unsupported public key algorithm\")\n\n\t// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field\n\tErrExtractPropertyFromKey = errors.New(\"unable to extract property from key\")\n\n\t// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported\n\tErrBadECCCurveName = errors.New(\"unsupported ECC curve name\")\n\n\t// ErrFailedCertSearch represents not able to find certificate in store\n\tErrFailedCertSearch = errors.New(\"unable to find certificate in store\")\n\n\t// ErrFailedX509Extract represents not being able to extract x509 certificate from found cert in store\n\tErrFailedX509Extract = errors.New(\"unable to extract x509 from certificate\")","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/errors.go#L15-L51","documentation":"ErrExtractingRSAPublicKey is returned when the public half of an RSA private key held in the Windows store cannot be obtained. It fires when exporting the key as a BCRYPT_RSAPUBLIC_BLOB fails (winExport error at certstore_windows.go:759) or when the exported blob cannot be unmarshalled into a Go RSA public key by winUnmarshalRSA (at :763).","triggerScenarios":"TLSConfig build on Windows with an RSA store key: winExport(kh, winBCryptRSAPublicBlob) errors at :759, or winUnmarshalRSA(buf) fails at :763 because the KSP returned a malformed or nonstandard RSA public blob.","commonSituations":"Third-party KSPs returning proprietary blob layouts; TPM/smart-card keys restricting public-key export; mismatch between the exported blob type and what the KSP actually produces; corrupted key entries.","solutions":["Use the Microsoft Software Key Storage Provider or a mainstream KSP that exports standard BCRYPT_RSAPUBLIC_BLOBs.","Update the smart-card minidriver / KSP / TPM firmware to a version that exports standard RSA public blobs.","Repair the key association with `certutil -repairstore My <thumbprint>` and retry.","Reissue/import the certificate with a standard RSA key if the current KSP keeps returning unusable blobs."],"exampleFix":"// before: exotic KSP blob -> ErrExtractingRSAPublicKey\n// after: import key under the standard CNG KSP\n// certutil -csp \"Microsoft Software Key Storage Provider\" -importpfx My server.pfx","handlingStrategy":"validation","validationCode":"// verify the RSA key is under a KSP that exports standard blobs\nksp := keyProviderName(handle)\nif ksp != \"Microsoft Software Key Storage Provider\" && !isKnownGoodKSP(ksp) {\n    log.Warnf(\"KSP %q may not export standard RSA public blobs\", ksp)\n}","typeGuard":"func isStandardKSP(provider string) bool {\n    switch provider {\n    case \"Microsoft Software Key Storage Provider\", \"Microsoft Platform Crypto Provider\":\n        return true\n    }\n    return false\n}","tryCatchPattern":"if errors.Is(err, certstore.ErrExtractingRSAPublicKey) {\n    return fmt.Errorf(\"reimport the key under a standard CNG KSP or update the vendor KSP: %w\", err)\n}","preventionTips":["Prefer Microsoft KSPs unless the HSM vendor KSP is verified to export BCRYPT_RSAPUBLIC_BLOBs.","Run a smoke test that acquires the signer before deploying behind TLS.","Repair key entries with certutil -repairstore when exports start failing.","Keep TPM firmware and minidrivers updated."],"tags":["windows","certificate-store","rsa","public-key","ncrypt"],"backgroundTag":"public-key-export-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}