ErrBadCryptoStoreProvider

ErrBadCryptoStoreProvider

Error message

unable to open certificate store or store not available

What it means

ErrBadCryptoStoreProvider indicates the library could not establish a link to a certificate store on the platform. On Windows, winNewStoreHandle fails when the crypto API (CertOpenStore) cannot open the requested store, and store-counting code also surfaces this error when a store handle cannot be created for the given provider.

Source

Thrown at server/certstore/errors.go:9

package certstore

import (
	"errors"
)

var (
	// ErrBadCryptoStoreProvider represents inablity to establish link with a certificate store
	ErrBadCryptoStoreProvider = errors.New("unable to open certificate store or store not available")

	// ErrBadRSAHashAlgorithm represents a bad or unsupported RSA hash algorithm
	ErrBadRSAHashAlgorithm = errors.New("unsupported RSA hash algorithm")

	// ErrBadSigningAlgorithm represents a bad or unsupported signing algorithm
	ErrBadSigningAlgorithm = errors.New("unsupported signing algorithm")

	// ErrStoreRSASigningError represents an error returned from store during RSA signature
	ErrStoreRSASigningError = errors.New("unable to obtain RSA signature from store")

	// ErrStoreECDSASigningError represents an error returned from store during ECDSA signature
	ErrStoreECDSASigningError = errors.New("unable to obtain ECDSA signature from store")

	// ErrNoPrivateKeyStoreRef represents an error getting a handle to a private key in store
	ErrNoPrivateKeyStoreRef = errors.New("unable to obtain private key handle from store")

	// ErrExtractingPrivateKeyMetadata represents a family of errors extracting metadata about the private key in store
	ErrExtractingPrivateKeyMetadata = errors.New("unable to extract private key metadata")

View on GitHub (pinned to 3a66a489d2)

Solutions

Verify the store name and provider constants passed to certstore (e.g. 'MY', 'Root') are valid Windows store names
Run under an account with permission to open the target certificate store (check CURRENT_USER vs LOCAL_MACHINE scope)
Import the certificate into the store you are referencing (certmgr.msc / certlm.msc)
If using crypto store providers (e.g. TPM/KSP), confirm the provider is installed and functional on the machine

Example fix

// before
store, err := certstore.OpenStore("Personal") // not a system store name
// after
store, err := certstore.OpenStore(certstore.StoreNameMy) // 'MY' system store

Defensive patterns

Strategy: validation

Validate before calling

// verify the store can be opened before use
if _, err := certstore.OpenStore(certstore.StoreNameMy); err != nil {
    return fmt.Errorf("certificate store unavailable: %w", err)
}

Try / catch

stores, err := certstore.OpenStores(provider)
if errors.Is(err, certstore.ErrBadCryptoStoreProvider) {
    return fmt.Errorf("cannot open certificate store %q: check name/permissions: %w", storeName, err)
}

Prevention

Use standard Windows system store names (MY, Root, CA)
Run the service under an account with access to the target store
Confirm certificates are actually imported into the referenced store
Test store access on the target machine before deployment

When it happens

Trigger: Calling certstore APIs with an invalid/unsupported provider or store name so CertOpenStore fails; requesting a system store that does not exist or is inaccessible.

Common situations: Windows environments where the certificate store name is misspelled, permissions block store access (e.g. service accounts lacking access to CURRENT_USER stores), or non-Windows builds misusing the Windows provider path.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/02e9ec015723c1ba. Report an issue: GitHub.