{"record":{"id":"a6ba1fd4c606d229","repo":"nats-io/nats-server","slug":"could-not-open-the-tpm-v","errorCode":null,"errorMessage":"could not open the TPM: %v","messagePattern":"could not open the TPM: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/tpm/js_ek_tpm_windows.go","lineNumber":248,"sourceCode":"func LoadJetStreamEncryptionKeyFromTPM(srkPassword, jsKeyFile, jsKeyPassword string, pcr int) (string, error) {\n\trwc, err := tpm2.OpenTPM()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"could not open the TPM: %v\", err)\n\t}\n\tdefer rwc.Close()\n\n\t// Load the key from the TPM\n\tsrkHandle, err := regenerateSRK(rwc, srkPassword)\n\tdefer func() {\n\t\ttpm2.FlushContext(rwc, srkHandle)\n\t}()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"unable to regenerate SRK from the TPM: %v\", err)\n\t}\n\tpublicBlob, privateBlob, err := readTPMKeysFromFile(jsKeyFile)\n\tif err != nil {\n\t\tif os.IsNotExist(err) {\n\t\t\tjsek, err := createAndSealJsEncryptionKey(rwc, srkHandle, srkPassword, jsKeyFile, jsKeyPassword, pcr)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", fmt.Errorf(\"unable to generate new key from the TPM: %v\", err)\n\t\t\t}\n\t\t\treturn jsek, nil\n\t\t}\n\t\treturn \"\", err\n\t}\n\treturn unsealJsEncrpytionKey(rwc, pcr, srkHandle, srkPassword, jsKeyPassword, publicBlob, privateBlob)\n}","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/tpm/js_ek_tpm_windows.go#L230-L266","documentation":"tpm2.OpenTPM could not open a connection to the TPM device at the start of LoadJetStreamEncryptionKeyFromTPM, so no JetStream encryption key operations (load, create, seal, unseal) can run. Typical causes: no TPM device present (/dev/tpmrm missing), insufficient permissions on the device node, another process holding the TPM exclusively, or a TPM simulator not running.","triggerScenarios":"Thrown at server/tpm/js_ek_tpm_windows.go:248 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify a TPM 2.0 device exists (e.g. /dev/tpmrm0) and the kernel driver is loaded","Check file permissions on the TPM device node for the server process","Ensure no other process holds the TPM exclusively (it is a single-open resource); close conflicting users or use a TPM resource manager","Start the TPM simulator if running in a simulated environment","Enable TPM in the firmware/BIOS if the machine has one but it is disabled"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}