{"record":{"id":"b3aa01eb4ce388d1","repo":"nats-io/nats-server","slug":"errstoreecdsasigningerror","errorCode":"ErrStoreECDSASigningError","errorMessage":"unable to obtain ECDSA signature from store","messagePattern":"unable to obtain ECDSA signature from store","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certstore/errors.go","lineNumber":21,"sourceCode":"import (\n\t\"errors\"\n)\n\nvar (\n\t// ErrBadCryptoStoreProvider represents inablity to establish link with a certificate store\n\tErrBadCryptoStoreProvider = errors.New(\"unable to open certificate store or store not available\")\n\n\t// ErrBadRSAHashAlgorithm represents a bad or unsupported RSA hash algorithm\n\tErrBadRSAHashAlgorithm = errors.New(\"unsupported RSA hash algorithm\")\n\n\t// ErrBadSigningAlgorithm represents a bad or unsupported signing algorithm\n\tErrBadSigningAlgorithm = errors.New(\"unsupported signing algorithm\")\n\n\t// ErrStoreRSASigningError represents an error returned from store during RSA signature\n\tErrStoreRSASigningError = errors.New(\"unable to obtain RSA signature from store\")\n\n\t// ErrStoreECDSASigningError represents an error returned from store during ECDSA signature\n\tErrStoreECDSASigningError = errors.New(\"unable to obtain ECDSA signature from store\")\n\n\t// ErrNoPrivateKeyStoreRef represents an error getting a handle to a private key in store\n\tErrNoPrivateKeyStoreRef = errors.New(\"unable to obtain private key handle from store\")\n\n\t// ErrExtractingPrivateKeyMetadata represents a family of errors extracting metadata about the private key in store\n\tErrExtractingPrivateKeyMetadata = errors.New(\"unable to extract private key metadata\")\n\n\t// ErrExtractingECCPublicKey represents an error exporting ECC-type public key from store\n\tErrExtractingECCPublicKey = errors.New(\"unable to extract ECC public key from store\")\n\n\t// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store\n\tErrExtractingRSAPublicKey = errors.New(\"unable to extract RSA public key from store\")\n\n\t// ErrExtractingPublicKey represents a general error exporting public key from store\n\tErrExtractingPublicKey = errors.New(\"unable to extract public key from store\")\n\n\t// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm\n\tErrBadPublicKeyAlgorithm = errors.New(\"unsupported public key algorithm\")","sourceCodeStart":3,"sourceCodeEnd":39,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/errors.go#L3-L39","documentation":"ErrStoreECDSASigningError is returned when the Windows CNG NCryptSignHash call for an ECDSA key fails (nonzero result) or, in the second usage site, when the signature buffer length returned by Windows does not match the expected size (`len(buf) != int(size)`). The library asked the certificate store to produce an ECDSA signature and Windows either failed or returned a malformed/mis-sized signature.","triggerScenarios":"Signing with a store-backed ECDSA key on Windows via TLSConfig: NCryptSignHash returns r != 0 at certstore_windows.go:575 or :590, or the returned signature length mismatches the queried size after the call succeeds.","commonSituations":"TPM- or smart-card-backed ECC keys refusing the operation; key handles gone stale after store reopen or card removal; ECC key in a KSP that does not fully support ECDSA signing; driver/KSP returning an unexpected signature encoding length.","solutions":["Reopen the certificate store and reacquire the key handle, then retry the operation.","Verify the ECC private key supports signing (key usage includes digital signature) and the smart card/TPM is present and unlocked.","Update the KSP/smart-card minidriver — some ECDSA implementations return mis-sized buffers, triggering the length check.","If the hardware KSP keeps failing, use a software ECC key or a P-256 key (widely supported) instead."],"exampleFix":"// before\nsig, err := staleSigner.Sign(rand, digest, crypto.SHA256) // card removed -> ErrStoreECDSASigningError\n// after\nif err != nil {\n    store.Reopen(); freshSigner = store.Signer(cert)\n    sig, err = freshSigner.Sign(rand, digest, crypto.SHA256)\n}","handlingStrategy":"retry","validationCode":"// confirm ECDSA key is reachable before signing\nalg, err := keyAlgorithmGroup(handle) // NCRYPT_ALGORITHM_GROUP_PROPERTY\nif err != nil || alg != \"ECDSA\" {\n    return fmt.Errorf(\"ECDSA key not usable in store\")\n}","typeGuard":"func isECDSAStoreSignError(err error) bool {\n    return errors.Is(err, certstore.ErrStoreECDSASigningError)\n}","tryCatchPattern":"sig, err := signer.Sign(rand, digest, crypto.SHA256)\nif errors.Is(err, certstore.ErrStoreECDSASigningError) {\n    signer = reopenAndReacquire(cert) // fresh handle after card/TPM hiccup\n    sig, err = signer.Sign(rand, digest, crypto.SHA256)\n}","preventionTips":["Use P-256 keys for maximum KSP/smart-card compatibility.","Keep minidrivers and TPM firmware up to date (mis-sized signatures come from old drivers).","Reacquire key handles after any card removal or store reopen.","Prefer software keys in CI/test environments."],"tags":["windows","certificate-store","ecdsa","ncrypt","signing"],"backgroundTag":"windows-key-operation-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}