What causes "unable to extract public key from store" in nats-io/nats-server?

Reacquire the private key handle (reopen the store) and retry — handles can become invalid.

ErrExtractingPublicKey

ErrExtractingPublicKey

Error message

unable to extract public key from store

What it means

ErrExtractingPublicKey is the general failure path for exporting a public key from the Windows store: the underlying winExport NCryptExportKey call (with padding flag 0) returns a nonzero result at certstore_windows.go:824 or :839. It is the fallback error for key-export failures that are not specifically classified as ECC- or RSA-extraction errors.

Source

Thrown at server/certstore/errors.go:36

	ErrStoreRSASigningError = errors.New("unable to obtain RSA signature from store")

	// ErrStoreECDSASigningError represents an error returned from store during ECDSA signature
	ErrStoreECDSASigningError = errors.New("unable to obtain ECDSA signature from store")

	// ErrNoPrivateKeyStoreRef represents an error getting a handle to a private key in store
	ErrNoPrivateKeyStoreRef = errors.New("unable to obtain private key handle from store")

	// ErrExtractingPrivateKeyMetadata represents a family of errors extracting metadata about the private key in store
	ErrExtractingPrivateKeyMetadata = errors.New("unable to extract private key metadata")

	// ErrExtractingECCPublicKey represents an error exporting ECC-type public key from store
	ErrExtractingECCPublicKey = errors.New("unable to extract ECC public key from store")

	// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store
	ErrExtractingRSAPublicKey = errors.New("unable to extract RSA public key from store")

	// ErrExtractingPublicKey represents a general error exporting public key from store
	ErrExtractingPublicKey = errors.New("unable to extract public key from store")

	// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm
	ErrBadPublicKeyAlgorithm = errors.New("unsupported public key algorithm")

	// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field
	ErrExtractPropertyFromKey = errors.New("unable to extract property from key")

	// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported
	ErrBadECCCurveName = errors.New("unsupported ECC curve name")

	// ErrFailedCertSearch represents not able to find certificate in store
	ErrFailedCertSearch = errors.New("unable to find certificate in store")

	// ErrFailedX509Extract represents not being able to extract x509 certificate from found cert in store
	ErrFailedX509Extract = errors.New("unable to extract x509 from certificate")

	// ErrBadMatchByType represents unknown CERT_MATCH_BY passed
	ErrBadMatchByType = errors.New("cert match by type not implemented")

View on GitHub (pinned to 3a66a489d2)

Solutions

Reacquire the private key handle (reopen the store) and retry — handles can become invalid.
Check the key's export policy in the KSP/HSM and enable export of the public key (public blobs are normally always allowed; failure indicates KSP restrictions).
Verify the requested export blob type matches the key's algorithm group (RSA blob for RSA keys, ECC blob for ECC keys).
Inspect the underlying NTSTATUS returned by NCryptExportKey for the precise failure reason and fix accordingly.

Example fix

// before: stale handle -> ErrExtractingPublicKey
buf, err := winExport(staleKh, blobType)
// after
kh, err := acquireKeyHandle(cert) // reacquire fresh handle
buf, err := winExport(kh, blobType)

Defensive patterns

Strategy: retry

Validate before calling

// validate the handle is still valid before exporting
if !isKeyHandleValid(handle) { // probe with a cheap property get
    handle = reacquireHandle(cert)
}

Type guard

func exportSucceeded(buf []byte, err error) bool {
    return err == nil && len(buf) > 0
}

Try / catch

buf, err := winExport(kh, blobType)
if errors.Is(err, certstore.ErrExtractingPublicKey) {
    kh = reacquireHandle(cert) // stale-handle recovery
    buf, err = winExport(kh, blobType)
}

Prevention

Don't cache NCrypt key handles across long-lived processes; reacquire on demand.
Match the requested blob type to the key's algorithm group.
Check HSM/KSP export policy allows NCryptExportKey for the requested blob.
Log the underlying NTSTATUS to distinguish policy denials from stale handles.

When it happens

Trigger: Calling the store's public-key export helper: NCryptExportKey returns r != 0 at certstore_windows.go:824 or :839 — e.g. the key handle is invalid, the KSP forbids export of the requested blob type, or the requested export blob format is unsupported for that key.

Common situations: Keys in HSMs/TPMs with export policies that block NCryptExportKey; stale key handles after store reopen; requesting a blob type the key's KSP doesn't support; insufficient ACLs on the key container.

Related errors

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/d85d899f961ddd77. Report an issue: GitHub.