nats-io/nats-server · error

ErrExtractingECCPublicKey

ErrExtractingECCPublicKey

Error message

unable to extract ECC public key from store

What it means

ErrExtractingECCPublicKey is returned when the public half of an ECC private key held in the Windows store cannot be obtained. It fires in two spots: when exporting the key as a BCRYPT_ECCKEY_BLOB fails (winExport error at certstore_windows.go:750), and when the exported blob fails to unmarshal into a Go crypto.PublicKey via unmarshalECC (at :754).

Source

Thrown at server/certstore/errors.go:30

	ErrBadRSAHashAlgorithm = errors.New("unsupported RSA hash algorithm")

	// ErrBadSigningAlgorithm represents a bad or unsupported signing algorithm
	ErrBadSigningAlgorithm = errors.New("unsupported signing algorithm")

	// ErrStoreRSASigningError represents an error returned from store during RSA signature
	ErrStoreRSASigningError = errors.New("unable to obtain RSA signature from store")

	// ErrStoreECDSASigningError represents an error returned from store during ECDSA signature
	ErrStoreECDSASigningError = errors.New("unable to obtain ECDSA signature from store")

	// ErrNoPrivateKeyStoreRef represents an error getting a handle to a private key in store
	ErrNoPrivateKeyStoreRef = errors.New("unable to obtain private key handle from store")

	// ErrExtractingPrivateKeyMetadata represents a family of errors extracting metadata about the private key in store
	ErrExtractingPrivateKeyMetadata = errors.New("unable to extract private key metadata")

	// ErrExtractingECCPublicKey represents an error exporting ECC-type public key from store
	ErrExtractingECCPublicKey = errors.New("unable to extract ECC public key from store")

	// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store
	ErrExtractingRSAPublicKey = errors.New("unable to extract RSA public key from store")

	// ErrExtractingPublicKey represents a general error exporting public key from store
	ErrExtractingPublicKey = errors.New("unable to extract public key from store")

	// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm
	ErrBadPublicKeyAlgorithm = errors.New("unsupported public key algorithm")

	// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field
	ErrExtractPropertyFromKey = errors.New("unable to extract property from key")

	// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported
	ErrBadECCCurveName = errors.New("unsupported ECC curve name")

	// ErrFailedCertSearch represents not able to find certificate in store
	ErrFailedCertSearch = errors.New("unable to find certificate in store")

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Use a Go-supported curve (P-256, P-384, P-521) when issuing the certificate — exotic curves fail unmarshalling.
2. Update the smart-card minidriver / KSP so it exports standard BCRYPT_ECCKEY_BLOB formats.
3. Re-pair or re-import the key to repair corrupted key material (certutil -repairstore).
4. If the key is on an unsupported curve, reissue the certificate with an ECC P-256 key.

Example fix

// before: cert on an exotic curve -> ErrExtractingECCPublicKey
// after: reissue with a supported curve
// openssl ecparam -name prime256v1 -genkey -out server.key && reissue cert

// ensure the ECC key uses a Go-supported curve before loading it
alg, _ := keyAlgorithmGroup(handle)
if alg == "ECDSA" {
    if curve := keyCurveName(handle); !isGoSupportedCurve(curve) { // P-256/384/521
        return fmt.Errorf("curve %q not supported", curve)
    }
}

func isSupportedECCCurve(name string) bool {
    switch name {
    case "P-256", "P-384", "P-521":
        return true
    }
    return false
}

if errors.Is(err, certstore.ErrExtractingECCPublicKey) {
    return fmt.Errorf("use a P-256/P-384/P-521 key or update the KSP so it exports standard ECC blobs: %w", err)
}

When it happens

Trigger: TLSConfig build on Windows with an ECDSA store key: winExport(kh, ECC public blob) returns an error at :750, or unmarshalECC(buf, kh) fails at :754 (malformed/unsupported curve blob returned by the KSP).

Common situations: Keys on non-standard curves that Windows exports but Go doesn't recognize; smart-card minidrivers exporting a blob in a nonstandard format; TPM keys whose export is restricted; corrupted key material in the store.

Related errors

• ErrStoreECDSASigningError
• ErrExtractingRSAPublicKey
• ErrExtractingPublicKey
• ErrStoreRSASigningError
• ErrNoPrivateKeyStoreRef

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/eb73c77acae8f6a8. Report an issue: GitHub.