nats-io/nats-server · error

ErrExtractingRSAPublicKey

ErrExtractingRSAPublicKey

Error message

unable to extract RSA public key from store

What it means

ErrExtractingRSAPublicKey is returned when the public half of an RSA private key held in the Windows store cannot be obtained. It fires when exporting the key as a BCRYPT_RSAPUBLIC_BLOB fails (winExport error at certstore_windows.go:759) or when the exported blob cannot be unmarshalled into a Go RSA public key by winUnmarshalRSA (at :763).

Source

Thrown at server/certstore/errors.go:33

	ErrBadSigningAlgorithm = errors.New("unsupported signing algorithm")

	// ErrStoreRSASigningError represents an error returned from store during RSA signature
	ErrStoreRSASigningError = errors.New("unable to obtain RSA signature from store")

	// ErrStoreECDSASigningError represents an error returned from store during ECDSA signature
	ErrStoreECDSASigningError = errors.New("unable to obtain ECDSA signature from store")

	// ErrNoPrivateKeyStoreRef represents an error getting a handle to a private key in store
	ErrNoPrivateKeyStoreRef = errors.New("unable to obtain private key handle from store")

	// ErrExtractingPrivateKeyMetadata represents a family of errors extracting metadata about the private key in store
	ErrExtractingPrivateKeyMetadata = errors.New("unable to extract private key metadata")

	// ErrExtractingECCPublicKey represents an error exporting ECC-type public key from store
	ErrExtractingECCPublicKey = errors.New("unable to extract ECC public key from store")

	// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store
	ErrExtractingRSAPublicKey = errors.New("unable to extract RSA public key from store")

	// ErrExtractingPublicKey represents a general error exporting public key from store
	ErrExtractingPublicKey = errors.New("unable to extract public key from store")

	// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm
	ErrBadPublicKeyAlgorithm = errors.New("unsupported public key algorithm")

	// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field
	ErrExtractPropertyFromKey = errors.New("unable to extract property from key")

	// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported
	ErrBadECCCurveName = errors.New("unsupported ECC curve name")

	// ErrFailedCertSearch represents not able to find certificate in store
	ErrFailedCertSearch = errors.New("unable to find certificate in store")

	// ErrFailedX509Extract represents not being able to extract x509 certificate from found cert in store
	ErrFailedX509Extract = errors.New("unable to extract x509 from certificate")

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Use the Microsoft Software Key Storage Provider or a mainstream KSP that exports standard BCRYPT_RSAPUBLIC_BLOBs.
2. Update the smart-card minidriver / KSP / TPM firmware to a version that exports standard RSA public blobs.
3. Repair the key association with `certutil -repairstore My <thumbprint>` and retry.
4. Reissue/import the certificate with a standard RSA key if the current KSP keeps returning unusable blobs.

Example fix

// before: exotic KSP blob -> ErrExtractingRSAPublicKey
// after: import key under the standard CNG KSP
// certutil -csp "Microsoft Software Key Storage Provider" -importpfx My server.pfx

// verify the RSA key is under a KSP that exports standard blobs
ksp := keyProviderName(handle)
if ksp != "Microsoft Software Key Storage Provider" && !isKnownGoodKSP(ksp) {
    log.Warnf("KSP %q may not export standard RSA public blobs", ksp)
}

func isStandardKSP(provider string) bool {
    switch provider {
    case "Microsoft Software Key Storage Provider", "Microsoft Platform Crypto Provider":
        return true
    }
    return false
}

if errors.Is(err, certstore.ErrExtractingRSAPublicKey) {
    return fmt.Errorf("reimport the key under a standard CNG KSP or update the vendor KSP: %w", err)
}

When it happens

Trigger: TLSConfig build on Windows with an RSA store key: winExport(kh, winBCryptRSAPublicBlob) errors at :759, or winUnmarshalRSA(buf) fails at :763 because the KSP returned a malformed or nonstandard RSA public blob.

Common situations: Third-party KSPs returning proprietary blob layouts; TPM/smart-card keys restricting public-key export; mismatch between the exported blob type and what the KSP actually produces; corrupted key entries.

Related errors

• ErrStoreRSASigningError
• ErrExtractingECCPublicKey
• ErrExtractingPublicKey
• ErrBadRSAHashAlgorithm
• ErrStoreECDSASigningError

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/982205289d4d5792. Report an issue: GitHub.