nats-io/nats-server · error

ErrExtractingPrivateKeyMetadata

ErrExtractingPrivateKeyMetadata

Error message

unable to extract private key metadata

What it means

ErrExtractingPrivateKeyMetadata is returned when the library obtains a private key handle from the Windows store but then fails to read its metadata: the key's unique name (NCryptGetProperty at :734) or the key's algorithm (at :740). Without the unique name or algorithm, the library cannot proceed to export/construct the corresponding public key.

Source

Thrown at server/certstore/errors.go:27

	ErrBadCryptoStoreProvider = errors.New("unable to open certificate store or store not available")

	// ErrBadRSAHashAlgorithm represents a bad or unsupported RSA hash algorithm
	ErrBadRSAHashAlgorithm = errors.New("unsupported RSA hash algorithm")

	// ErrBadSigningAlgorithm represents a bad or unsupported signing algorithm
	ErrBadSigningAlgorithm = errors.New("unsupported signing algorithm")

	// ErrStoreRSASigningError represents an error returned from store during RSA signature
	ErrStoreRSASigningError = errors.New("unable to obtain RSA signature from store")

	// ErrStoreECDSASigningError represents an error returned from store during ECDSA signature
	ErrStoreECDSASigningError = errors.New("unable to obtain ECDSA signature from store")

	// ErrNoPrivateKeyStoreRef represents an error getting a handle to a private key in store
	ErrNoPrivateKeyStoreRef = errors.New("unable to obtain private key handle from store")

	// ErrExtractingPrivateKeyMetadata represents a family of errors extracting metadata about the private key in store
	ErrExtractingPrivateKeyMetadata = errors.New("unable to extract private key metadata")

	// ErrExtractingECCPublicKey represents an error exporting ECC-type public key from store
	ErrExtractingECCPublicKey = errors.New("unable to extract ECC public key from store")

	// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store
	ErrExtractingRSAPublicKey = errors.New("unable to extract RSA public key from store")

	// ErrExtractingPublicKey represents a general error exporting public key from store
	ErrExtractingPublicKey = errors.New("unable to extract public key from store")

	// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm
	ErrBadPublicKeyAlgorithm = errors.New("unsupported public key algorithm")

	// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field
	ErrExtractPropertyFromKey = errors.New("unable to extract property from key")

	// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported
	ErrBadECCCurveName = errors.New("unsupported ECC curve name")

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Repair the certificate/key association with `certutil -repairstore My <thumbprint>` to restore key properties.
2. Verify the key is CNG-based (KSP), not a legacy CryptoAPI CSP key — migrate or re-import the key as CNG.
3. Update or replace the smart-card minidriver / KSP so it implements the required NCrypt property queries.
4. Re-export and re-import the certificate and key into the store to rebuild the key metadata.

Example fix

// before: legacy CSP key without CNG properties -> ErrExtractingPrivateKeyMetadata
// after: convert/migrate the key to a CNG KSP
// certutil -csp "Microsoft Software Key Storage Provider" -importpfx My server.pfx

// probe key metadata before use
name, err := keyUniqueName(handle)
alg, err2 := keyAlgorithmGroup(handle)
if err != nil || err2 != nil {
    return fmt.Errorf("KSP does not expose NCrypt properties; migrate key to a CNG KSP")
}

func keyMetadataReadable(kh uintptr) bool {
    _, err := keyUniqueName(kh)
    if err != nil {
        return false
    }
    _, err = keyAlgorithmGroup(kh)
    return err == nil
}

if errors.Is(err, certstore.ErrExtractingPrivateKeyMetadata) {
    return fmt.Errorf("repair the key entry (certutil -repairstore) or use a CNG KSP: %w", err)
}

When it happens

Trigger: TLSConfig path on Windows after acquiring a private key handle: NCRYPT_NAME_PROPERTY / unique-name property query fails at certstore_windows.go:734, or the algorithm property query (NCRYPT_ALGORITHM_GROUP_PROPERTY) fails at :740 — both wrapped as ErrExtractingPrivateKeyMetadata.

Common situations: KSPs (some smart-card minidrivers, third-party CSP/KSP bridges) that don't implement standard NCrypt property queries; corrupted key entries in the store; legacy CSP-only keys accessed through the CNG bridge lacking CNG properties.

Related errors

• ErrStoreRSASigningError
• ErrStoreECDSASigningError
• ErrNoPrivateKeyStoreRef
• ErrExtractingECCPublicKey
• ErrExtractingRSAPublicKey

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/b769401873826fe5. Report an issue: GitHub.