{"record":{"id":"b769401873826fe5","repo":"nats-io/nats-server","slug":"errextractingprivatekeymetadata","errorCode":"ErrExtractingPrivateKeyMetadata","errorMessage":"unable to extract private key metadata","messagePattern":"unable to extract private key metadata","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certstore/errors.go","lineNumber":27,"sourceCode":"\tErrBadCryptoStoreProvider = errors.New(\"unable to open certificate store or store not available\")\n\n\t// ErrBadRSAHashAlgorithm represents a bad or unsupported RSA hash algorithm\n\tErrBadRSAHashAlgorithm = errors.New(\"unsupported RSA hash algorithm\")\n\n\t// ErrBadSigningAlgorithm represents a bad or unsupported signing algorithm\n\tErrBadSigningAlgorithm = errors.New(\"unsupported signing algorithm\")\n\n\t// ErrStoreRSASigningError represents an error returned from store during RSA signature\n\tErrStoreRSASigningError = errors.New(\"unable to obtain RSA signature from store\")\n\n\t// ErrStoreECDSASigningError represents an error returned from store during ECDSA signature\n\tErrStoreECDSASigningError = errors.New(\"unable to obtain ECDSA signature from store\")\n\n\t// ErrNoPrivateKeyStoreRef represents an error getting a handle to a private key in store\n\tErrNoPrivateKeyStoreRef = errors.New(\"unable to obtain private key handle from store\")\n\n\t// ErrExtractingPrivateKeyMetadata represents a family of errors extracting metadata about the private key in store\n\tErrExtractingPrivateKeyMetadata = errors.New(\"unable to extract private key metadata\")\n\n\t// ErrExtractingECCPublicKey represents an error exporting ECC-type public key from store\n\tErrExtractingECCPublicKey = errors.New(\"unable to extract ECC public key from store\")\n\n\t// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store\n\tErrExtractingRSAPublicKey = errors.New(\"unable to extract RSA public key from store\")\n\n\t// ErrExtractingPublicKey represents a general error exporting public key from store\n\tErrExtractingPublicKey = errors.New(\"unable to extract public key from store\")\n\n\t// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm\n\tErrBadPublicKeyAlgorithm = errors.New(\"unsupported public key algorithm\")\n\n\t// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field\n\tErrExtractPropertyFromKey = errors.New(\"unable to extract property from key\")\n\n\t// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported\n\tErrBadECCCurveName = errors.New(\"unsupported ECC curve name\")","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/errors.go#L9-L45","documentation":"ErrExtractingPrivateKeyMetadata is returned when the library obtains a private key handle from the Windows store but then fails to read its metadata: the key's unique name (NCryptGetProperty at :734) or the key's algorithm (at :740). Without the unique name or algorithm, the library cannot proceed to export/construct the corresponding public key.","triggerScenarios":"TLSConfig path on Windows after acquiring a private key handle: NCRYPT_NAME_PROPERTY / unique-name property query fails at certstore_windows.go:734, or the algorithm property query (NCRYPT_ALGORITHM_GROUP_PROPERTY) fails at :740 — both wrapped as ErrExtractingPrivateKeyMetadata.","commonSituations":"KSPs (some smart-card minidrivers, third-party CSP/KSP bridges) that don't implement standard NCrypt property queries; corrupted key entries in the store; legacy CSP-only keys accessed through the CNG bridge lacking CNG properties.","solutions":["Repair the certificate/key association with `certutil -repairstore My <thumbprint>` to restore key properties.","Verify the key is CNG-based (KSP), not a legacy CryptoAPI CSP key — migrate or re-import the key as CNG.","Update or replace the smart-card minidriver / KSP so it implements the required NCrypt property queries.","Re-export and re-import the certificate and key into the store to rebuild the key metadata."],"exampleFix":"// before: legacy CSP key without CNG properties -> ErrExtractingPrivateKeyMetadata\n// after: convert/migrate the key to a CNG KSP\n// certutil -csp \"Microsoft Software Key Storage Provider\" -importpfx My server.pfx","handlingStrategy":"validation","validationCode":"// probe key metadata before use\nname, err := keyUniqueName(handle)\nalg, err2 := keyAlgorithmGroup(handle)\nif err != nil || err2 != nil {\n    return fmt.Errorf(\"KSP does not expose NCrypt properties; migrate key to a CNG KSP\")\n}","typeGuard":"func keyMetadataReadable(kh uintptr) bool {\n    _, err := keyUniqueName(kh)\n    if err != nil {\n        return false\n    }\n    _, err = keyAlgorithmGroup(kh)\n    return err == nil\n}","tryCatchPattern":"if errors.Is(err, certstore.ErrExtractingPrivateKeyMetadata) {\n    return fmt.Errorf(\"repair the key entry (certutil -repairstore) or use a CNG KSP: %w\", err)\n}","preventionTips":["Provision keys under a CNG KSP (Microsoft Software Key Storage Provider), not legacy CSPs.","Avoid obscure third-party minidrivers that skip NCrypt property queries.","Repair broken key associations with certutil -repairstore.","Re-import cert+key if metadata appears corrupted."],"tags":["windows","certificate-store","ncrypt","key-metadata"],"backgroundTag":"key-metadata-extraction-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}