nats-io/nats-server · error

unable to create seed: %v

Error message

unable to create seed: %v

What it means

nkeys.CreateUser failed while generating the random nkey seed that serves as the JetStream encryption key. This is a local cryptographic randomness failure (crypto/rand read error), not a TPM problem; without a fresh seed there is no key material to seal.

Source

Thrown at server/tpm/js_ek_tpm_windows.go:158

if err := tpm2.FlushContext(rwc, sessHandle); err != nil {
	return "", fmt.Errorf("unable to flush session: %v", err)
}
// Seal the data to the parent key and the policy
user, err := nkeys.CreateUser()
if err != nil {
	return "", fmt.Errorf("unable to create seed: %v", err)
}
// We'll use the seed to represent the encryption key.
jsStoreKey, err := user.Seed()
if err != nil {
	return "", fmt.Errorf("unable to get seed: %v", err)
}

View on GitHub (pinned to 3a66a489d2)

Solutions

  1. Check system entropy availability (/dev/urandom) and OS-level crypto/rand errors in the wrapped message
  2. Simply retry: seed generation failures are typically transient
  3. Investigate the host's random source if failures persist
Defensive patterns

Strategy: retry

When it happens

Trigger: Thrown at server/tpm/js_ek_tpm_windows.go:158 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/ccb812af335a8edb. Report an issue: GitHub.