nats-io/nats-server · error

could not open the TPM: %v

Error message

could not open the TPM: %v

What it means

tpm2.OpenTPM could not open a connection to the TPM device at the start of LoadJetStreamEncryptionKeyFromTPM, so no JetStream encryption key operations (load, create, seal, unseal) can run. Typical causes: no TPM device present (/dev/tpmrm missing), insufficient permissions on the device node, another process holding the TPM exclusively, or a TPM simulator not running.

Source

Thrown at server/tpm/js_ek_tpm_windows.go:248

func LoadJetStreamEncryptionKeyFromTPM(srkPassword, jsKeyFile, jsKeyPassword string, pcr int) (string, error) {
	rwc, err := tpm2.OpenTPM()
	if err != nil {
		return "", fmt.Errorf("could not open the TPM: %v", err)
	}
	defer rwc.Close()

	// Load the key from the TPM
	srkHandle, err := regenerateSRK(rwc, srkPassword)
	defer func() {
		tpm2.FlushContext(rwc, srkHandle)
	}()
	if err != nil {
		return "", fmt.Errorf("unable to regenerate SRK from the TPM: %v", err)
	}
	publicBlob, privateBlob, err := readTPMKeysFromFile(jsKeyFile)
	if err != nil {
		if os.IsNotExist(err) {
			jsek, err := createAndSealJsEncryptionKey(rwc, srkHandle, srkPassword, jsKeyFile, jsKeyPassword, pcr)
			if err != nil {
				return "", fmt.Errorf("unable to generate new key from the TPM: %v", err)
			}
			return jsek, nil
		}
		return "", err
	}
	return unsealJsEncrpytionKey(rwc, pcr, srkHandle, srkPassword, jsKeyPassword, publicBlob, privateBlob)
}

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Verify a TPM 2.0 device exists (e.g. /dev/tpmrm0) and the kernel driver is loaded
2. Check file permissions on the TPM device node for the server process
3. Ensure no other process holds the TPM exclusively (it is a single-open resource); close conflicting users or use a TPM resource manager
4. Start the TPM simulator if running in a simulated environment
5. Enable TPM in the firmware/BIOS if the machine has one but it is disabled

When it happens

Trigger: Thrown at server/tpm/js_ek_tpm_windows.go:248 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/a6ba1fd4c606d229. Report an issue: GitHub.