{"record":{"id":"eb73c77acae8f6a8","repo":"nats-io/nats-server","slug":"errextractingeccpublickey","errorCode":"ErrExtractingECCPublicKey","errorMessage":"unable to extract ECC public key from store","messagePattern":"unable to extract ECC public key from store","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certstore/errors.go","lineNumber":30,"sourceCode":"\tErrBadRSAHashAlgorithm = errors.New(\"unsupported RSA hash algorithm\")\n\n\t// ErrBadSigningAlgorithm represents a bad or unsupported signing algorithm\n\tErrBadSigningAlgorithm = errors.New(\"unsupported signing algorithm\")\n\n\t// ErrStoreRSASigningError represents an error returned from store during RSA signature\n\tErrStoreRSASigningError = errors.New(\"unable to obtain RSA signature from store\")\n\n\t// ErrStoreECDSASigningError represents an error returned from store during ECDSA signature\n\tErrStoreECDSASigningError = errors.New(\"unable to obtain ECDSA signature from store\")\n\n\t// ErrNoPrivateKeyStoreRef represents an error getting a handle to a private key in store\n\tErrNoPrivateKeyStoreRef = errors.New(\"unable to obtain private key handle from store\")\n\n\t// ErrExtractingPrivateKeyMetadata represents a family of errors extracting metadata about the private key in store\n\tErrExtractingPrivateKeyMetadata = errors.New(\"unable to extract private key metadata\")\n\n\t// ErrExtractingECCPublicKey represents an error exporting ECC-type public key from store\n\tErrExtractingECCPublicKey = errors.New(\"unable to extract ECC public key from store\")\n\n\t// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store\n\tErrExtractingRSAPublicKey = errors.New(\"unable to extract RSA public key from store\")\n\n\t// ErrExtractingPublicKey represents a general error exporting public key from store\n\tErrExtractingPublicKey = errors.New(\"unable to extract public key from store\")\n\n\t// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm\n\tErrBadPublicKeyAlgorithm = errors.New(\"unsupported public key algorithm\")\n\n\t// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field\n\tErrExtractPropertyFromKey = errors.New(\"unable to extract property from key\")\n\n\t// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported\n\tErrBadECCCurveName = errors.New(\"unsupported ECC curve name\")\n\n\t// ErrFailedCertSearch represents not able to find certificate in store\n\tErrFailedCertSearch = errors.New(\"unable to find certificate in store\")","sourceCodeStart":12,"sourceCodeEnd":48,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certstore/errors.go#L12-L48","documentation":"ErrExtractingECCPublicKey is returned when the public half of an ECC private key held in the Windows store cannot be obtained. It fires in two spots: when exporting the key as a BCRYPT_ECCKEY_BLOB fails (winExport error at certstore_windows.go:750), and when the exported blob fails to unmarshal into a Go crypto.PublicKey via unmarshalECC (at :754).","triggerScenarios":"TLSConfig build on Windows with an ECDSA store key: winExport(kh, ECC public blob) returns an error at :750, or unmarshalECC(buf, kh) fails at :754 (malformed/unsupported curve blob returned by the KSP).","commonSituations":"Keys on non-standard curves that Windows exports but Go doesn't recognize; smart-card minidrivers exporting a blob in a nonstandard format; TPM keys whose export is restricted; corrupted key material in the store.","solutions":["Use a Go-supported curve (P-256, P-384, P-521) when issuing the certificate — exotic curves fail unmarshalling.","Update the smart-card minidriver / KSP so it exports standard BCRYPT_ECCKEY_BLOB formats.","Re-pair or re-import the key to repair corrupted key material (certutil -repairstore).","If the key is on an unsupported curve, reissue the certificate with an ECC P-256 key."],"exampleFix":"// before: cert on an exotic curve -> ErrExtractingECCPublicKey\n// after: reissue with a supported curve\n// openssl ecparam -name prime256v1 -genkey -out server.key && reissue cert","handlingStrategy":"validation","validationCode":"// ensure the ECC key uses a Go-supported curve before loading it\nalg, _ := keyAlgorithmGroup(handle)\nif alg == \"ECDSA\" {\n    if curve := keyCurveName(handle); !isGoSupportedCurve(curve) { // P-256/384/521\n        return fmt.Errorf(\"curve %q not supported\", curve)\n    }\n}","typeGuard":"func isSupportedECCCurve(name string) bool {\n    switch name {\n    case \"P-256\", \"P-384\", \"P-521\":\n        return true\n    }\n    return false\n}","tryCatchPattern":"if errors.Is(err, certstore.ErrExtractingECCPublicKey) {\n    return fmt.Errorf(\"use a P-256/P-384/P-521 key or update the KSP so it exports standard ECC blobs: %w\", err)\n}","preventionTips":["Issue ECC certificates only on P-256/P-384/P-521 curves.","Keep smart-card minidrivers current so exports match BCRYPT_ECCKEY_BLOB layout.","Avoid TPM-backed keys with restricted export for certificates served by Go apps.","Test key export on the target machine before deploying."],"tags":["windows","certificate-store","ecdsa","public-key","ncrypt"],"backgroundTag":"public-key-export-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}