{"record":{"id":"e601a86fc6cdc7bb","repo":"nats-io/nats-server","slug":"unable-to-extract-property-from-key","errorCode":null,"errorMessage":"unable to extract property from key","messagePattern":"unable to extract property from key","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certstore/errors.go","lineNumber":42,"sourceCode":"\tErrNoPrivateKeyStoreRef = errors.New(\"unable to obtain private key handle from store\")\n\n\t// ErrExtractingPrivateKeyMetadata represents a family of errors extracting metadata about the private key in store\n\tErrExtractingPrivateKeyMetadata = errors.New(\"unable to extract private key metadata\")\n\n\t// ErrExtractingECCPublicKey represents an error exporting ECC-type public key from store\n\tErrExtractingECCPublicKey = errors.New(\"unable to extract ECC public key from store\")\n\n\t// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store\n\tErrExtractingRSAPublicKey = errors.New(\"unable to extract RSA public key from store\")\n\n\t// ErrExtractingPublicKey represents a general error exporting public key from store\n\tErrExtractingPublicKey = errors.New(\"unable to extract public key from store\")\n\n\t// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm\n\tErrBadPublicKeyAlgorithm = errors.New(\"unsupported public key algorithm\")\n\n\t// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field\n\tErrExtractPropertyFromKey = errors.New(\"unable to extract property from key\")\n\n\t// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported\n\tErrBadECCCurveName = errors.New(\"unsupported ECC curve name\")\n\n\t// ErrFailedCertSearch represents not able to find certificate in store\n\tErrFailedCertSearch = errors.New(\"unable to find certificate in store\")\n\n\t// ErrFailedX509Extract represents not being able to extract x509 certificate from found cert in store\n\tErrFailedX509Extract = errors.New(\"unable to extract x509 from certificate\")\n\n\t// ErrBadMatchByType represents unknown CERT_MATCH_BY passed\n\tErrBadMatchByType = errors.New(\"cert match by type not implemented\")\n\n\t// ErrBadCertStore represents unknown CERT_STORE passed\n\tErrBadCertStore = errors.New(\"cert store type not implemented\")\n\n\t// ErrConflictCertFileAndStore represents ambiguous configuration of both file and store\n\tErrConflictCertFileAndStore = errors.New(\"'cert_file' and 'cert_store' may not both be configured\")","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/errors.go#L24-L60","documentation":"ErrExtractPropertyFromKey is returned by the Windows certificate store (certKey path) when a CryptoAPI call fails while extracting a metadata property (public key blob) from a certificate context property. It is a generic 'property extraction failed' sentinel wrapping failure of CryptGetKeyProperty/CryptExportPublicKeyInfo-style calls. It means the store found the certificate but could not convert its key material into a usable Go crypto key.","triggerScenarios":"Calling TLSConfig/certSearch on Windows leads to cs.certKey(ctx); certstore_windows.go:783 and :796 return this sentinel when the underlying property-extraction API returns a non-zero r (e.g. extracting the public key from an acquired key context fails).","commonSituations":"Windows machine/user store certificates whose private key is inaccessible (permission issues, key stored on a smartcard/HSM with no CSP available), corrupted key properties, or certificates where the key provider cannot be resolved by the current process user.","solutions":["Verify the certificate's private key is accessible: open certmgr.msc, confirm the key has a private key and the running user/service has read access to it.","Re-import the certificate into the store ensuring the private key is included (PFX import with exportable key) rather than a cert-only import.","Run the process under an account with rights to the key's machine key container, or move the cert to the correct store (LocalMachine vs CurrentUser).","If the key lives on a smartcard/HSM, ensure the corresponding CSP/KSP driver is installed and the token is present."],"exampleFix":"// before: key stored only as public cert, extraction fails\nCertStore: \"SystemRoot\"\n// after: import PFX with private key into LocalMachine\\My\n// certutil -f -p <pass> -importpfx my.pfx","handlingStrategy":"try-catch","validationCode":"// Go: before relying on store cert, confirm key is exportable\nctx, err := certstore.AcquireContext(\"LocalMachine\\\\My\")\nif err != nil { log.Fatal(err) }\n// certKey failure is environment-side; pre-check private key presence via certutil -repairstore My <thumbprint>","typeGuard":"func isExtractPropErr(err error) bool { return errors.Is(err, certstore.ErrExtractPropertyFromKey) }","tryCatchPattern":"pk, err := cs.TLSConfig(...)\nif errors.Is(err, certstore.ErrExtractPropertyFromKey) {\n    // fall back to file-based certs or fail startup with a clear message\n}","preventionTips":["Import certificates as PFX with private key included and marked exportable","Grant the service account read access to the key container","Keep smartcard/HSM KSP drivers installed and tokens present"],"tags":["windows","certstore","cryptoapi","private-key"],"backgroundTag":"certificate-key-extraction-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}