nats-io/nats-server · error

ErrStoreECDSASigningError

ErrStoreECDSASigningError

Error message

unable to obtain ECDSA signature from store

What it means

ErrStoreECDSASigningError is returned when the Windows CNG NCryptSignHash call for an ECDSA key fails (nonzero result) or, in the second usage site, when the signature buffer length returned by Windows does not match the expected size (`len(buf) != int(size)`). The library asked the certificate store to produce an ECDSA signature and Windows either failed or returned a malformed/mis-sized signature.

Source

Thrown at server/certstore/errors.go:21

import (
	"errors"
)

var (
	// ErrBadCryptoStoreProvider represents inablity to establish link with a certificate store
	ErrBadCryptoStoreProvider = errors.New("unable to open certificate store or store not available")

	// ErrBadRSAHashAlgorithm represents a bad or unsupported RSA hash algorithm
	ErrBadRSAHashAlgorithm = errors.New("unsupported RSA hash algorithm")

	// ErrBadSigningAlgorithm represents a bad or unsupported signing algorithm
	ErrBadSigningAlgorithm = errors.New("unsupported signing algorithm")

	// ErrStoreRSASigningError represents an error returned from store during RSA signature
	ErrStoreRSASigningError = errors.New("unable to obtain RSA signature from store")

	// ErrStoreECDSASigningError represents an error returned from store during ECDSA signature
	ErrStoreECDSASigningError = errors.New("unable to obtain ECDSA signature from store")

	// ErrNoPrivateKeyStoreRef represents an error getting a handle to a private key in store
	ErrNoPrivateKeyStoreRef = errors.New("unable to obtain private key handle from store")

	// ErrExtractingPrivateKeyMetadata represents a family of errors extracting metadata about the private key in store
	ErrExtractingPrivateKeyMetadata = errors.New("unable to extract private key metadata")

	// ErrExtractingECCPublicKey represents an error exporting ECC-type public key from store
	ErrExtractingECCPublicKey = errors.New("unable to extract ECC public key from store")

	// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store
	ErrExtractingRSAPublicKey = errors.New("unable to extract RSA public key from store")

	// ErrExtractingPublicKey represents a general error exporting public key from store
	ErrExtractingPublicKey = errors.New("unable to extract public key from store")

	// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm
	ErrBadPublicKeyAlgorithm = errors.New("unsupported public key algorithm")

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Reopen the certificate store and reacquire the key handle, then retry the operation.
2. Verify the ECC private key supports signing (key usage includes digital signature) and the smart card/TPM is present and unlocked.
3. Update the KSP/smart-card minidriver — some ECDSA implementations return mis-sized buffers, triggering the length check.
4. If the hardware KSP keeps failing, use a software ECC key or a P-256 key (widely supported) instead.

Example fix

// before
sig, err := staleSigner.Sign(rand, digest, crypto.SHA256) // card removed -> ErrStoreECDSASigningError
// after
if err != nil {
    store.Reopen(); freshSigner = store.Signer(cert)
    sig, err = freshSigner.Sign(rand, digest, crypto.SHA256)
}

// confirm ECDSA key is reachable before signing
alg, err := keyAlgorithmGroup(handle) // NCRYPT_ALGORITHM_GROUP_PROPERTY
if err != nil || alg != "ECDSA" {
    return fmt.Errorf("ECDSA key not usable in store")
}

func isECDSAStoreSignError(err error) bool {
    return errors.Is(err, certstore.ErrStoreECDSASigningError)
}

sig, err := signer.Sign(rand, digest, crypto.SHA256)
if errors.Is(err, certstore.ErrStoreECDSASigningError) {
    signer = reopenAndReacquire(cert) // fresh handle after card/TPM hiccup
    sig, err = signer.Sign(rand, digest, crypto.SHA256)
}

When it happens

Trigger: Signing with a store-backed ECDSA key on Windows via TLSConfig: NCryptSignHash returns r != 0 at certstore_windows.go:575 or :590, or the returned signature length mismatches the queried size after the call succeeds.

Common situations: TPM- or smart-card-backed ECC keys refusing the operation; key handles gone stale after store reopen or card removal; ECC key in a KSP that does not fully support ECDSA signing; driver/KSP returning an unexpected signature encoding length.

Related errors

• ErrStoreRSASigningError
• ErrExtractingECCPublicKey
• ErrBadRSAHashAlgorithm
• ErrBadSigningAlgorithm
• ErrNoPrivateKeyStoreRef

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/b3aa01eb4ce388d1. Report an issue: GitHub.