{"record":{"id":"d85d899f961ddd77","repo":"nats-io/nats-server","slug":"errextractingpublickey","errorCode":"ErrExtractingPublicKey","errorMessage":"unable to extract public key from store","messagePattern":"unable to extract public key from store","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certstore/errors.go","lineNumber":36,"sourceCode":"\tErrStoreRSASigningError = errors.New(\"unable to obtain RSA signature from store\")\n\n\t// ErrStoreECDSASigningError represents an error returned from store during ECDSA signature\n\tErrStoreECDSASigningError = errors.New(\"unable to obtain ECDSA signature from store\")\n\n\t// ErrNoPrivateKeyStoreRef represents an error getting a handle to a private key in store\n\tErrNoPrivateKeyStoreRef = errors.New(\"unable to obtain private key handle from store\")\n\n\t// ErrExtractingPrivateKeyMetadata represents a family of errors extracting metadata about the private key in store\n\tErrExtractingPrivateKeyMetadata = errors.New(\"unable to extract private key metadata\")\n\n\t// ErrExtractingECCPublicKey represents an error exporting ECC-type public key from store\n\tErrExtractingECCPublicKey = errors.New(\"unable to extract ECC public key from store\")\n\n\t// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store\n\tErrExtractingRSAPublicKey = errors.New(\"unable to extract RSA public key from store\")\n\n\t// ErrExtractingPublicKey represents a general error exporting public key from store\n\tErrExtractingPublicKey = errors.New(\"unable to extract public key from store\")\n\n\t// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm\n\tErrBadPublicKeyAlgorithm = errors.New(\"unsupported public key algorithm\")\n\n\t// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field\n\tErrExtractPropertyFromKey = errors.New(\"unable to extract property from key\")\n\n\t// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported\n\tErrBadECCCurveName = errors.New(\"unsupported ECC curve name\")\n\n\t// ErrFailedCertSearch represents not able to find certificate in store\n\tErrFailedCertSearch = errors.New(\"unable to find certificate in store\")\n\n\t// ErrFailedX509Extract represents not being able to extract x509 certificate from found cert in store\n\tErrFailedX509Extract = errors.New(\"unable to extract x509 from certificate\")\n\n\t// ErrBadMatchByType represents unknown CERT_MATCH_BY passed\n\tErrBadMatchByType = errors.New(\"cert match by type not implemented\")","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/errors.go#L18-L54","documentation":"ErrExtractingPublicKey is the general failure path for exporting a public key from the Windows store: the underlying winExport NCryptExportKey call (with padding flag 0) returns a nonzero result at certstore_windows.go:824 or :839. It is the fallback error for key-export failures that are not specifically classified as ECC- or RSA-extraction errors.","triggerScenarios":"Calling the store's public-key export helper: NCryptExportKey returns r != 0 at certstore_windows.go:824 or :839 — e.g. the key handle is invalid, the KSP forbids export of the requested blob type, or the requested export blob format is unsupported for that key.","commonSituations":"Keys in HSMs/TPMs with export policies that block NCryptExportKey; stale key handles after store reopen; requesting a blob type the key's KSP doesn't support; insufficient ACLs on the key container.","solutions":["Reacquire the private key handle (reopen the store) and retry — handles can become invalid.","Check the key's export policy in the KSP/HSM and enable export of the public key (public blobs are normally always allowed; failure indicates KSP restrictions).","Verify the requested export blob type matches the key's algorithm group (RSA blob for RSA keys, ECC blob for ECC keys).","Inspect the underlying NTSTATUS returned by NCryptExportKey for the precise failure reason and fix accordingly."],"exampleFix":"// before: stale handle -> ErrExtractingPublicKey\nbuf, err := winExport(staleKh, blobType)\n// after\nkh, err := acquireKeyHandle(cert) // reacquire fresh handle\nbuf, err := winExport(kh, blobType)","handlingStrategy":"retry","validationCode":"// validate the handle is still valid before exporting\nif !isKeyHandleValid(handle) { // probe with a cheap property get\n    handle = reacquireHandle(cert)\n}","typeGuard":"func exportSucceeded(buf []byte, err error) bool {\n    return err == nil && len(buf) > 0\n}","tryCatchPattern":"buf, err := winExport(kh, blobType)\nif errors.Is(err, certstore.ErrExtractingPublicKey) {\n    kh = reacquireHandle(cert) // stale-handle recovery\n    buf, err = winExport(kh, blobType)\n}","preventionTips":["Don't cache NCrypt key handles across long-lived processes; reacquire on demand.","Match the requested blob type to the key's algorithm group.","Check HSM/KSP export policy allows NCryptExportKey for the requested blob.","Log the underlying NTSTATUS to distinguish policy denials from stale handles."],"tags":["windows","certificate-store","public-key","ncrypt","key-export"],"backgroundTag":"public-key-export-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}