nats-io/nats-server · error

unable to extract property from key

Error message

unable to extract property from key

What it means

ErrExtractPropertyFromKey is returned by the Windows certificate store (certKey path) when a CryptoAPI call fails while extracting a metadata property (public key blob) from a certificate context property. It is a generic 'property extraction failed' sentinel wrapping failure of CryptGetKeyProperty/CryptExportPublicKeyInfo-style calls. It means the store found the certificate but could not convert its key material into a usable Go crypto key.

Source

Thrown at server/certstore/errors.go:42

	ErrNoPrivateKeyStoreRef = errors.New("unable to obtain private key handle from store")

	// ErrExtractingPrivateKeyMetadata represents a family of errors extracting metadata about the private key in store
	ErrExtractingPrivateKeyMetadata = errors.New("unable to extract private key metadata")

	// ErrExtractingECCPublicKey represents an error exporting ECC-type public key from store
	ErrExtractingECCPublicKey = errors.New("unable to extract ECC public key from store")

	// ErrExtractingRSAPublicKey represents an error exporting RSA-type public key from store
	ErrExtractingRSAPublicKey = errors.New("unable to extract RSA public key from store")

	// ErrExtractingPublicKey represents a general error exporting public key from store
	ErrExtractingPublicKey = errors.New("unable to extract public key from store")

	// ErrBadPublicKeyAlgorithm represents a bad or unsupported public key algorithm
	ErrBadPublicKeyAlgorithm = errors.New("unsupported public key algorithm")

	// ErrExtractPropertyFromKey represents a general failure to extract a metadata property field
	ErrExtractPropertyFromKey = errors.New("unable to extract property from key")

	// ErrBadECCCurveName represents an ECC signature curve name that is bad or unsupported
	ErrBadECCCurveName = errors.New("unsupported ECC curve name")

	// ErrFailedCertSearch represents not able to find certificate in store
	ErrFailedCertSearch = errors.New("unable to find certificate in store")

	// ErrFailedX509Extract represents not being able to extract x509 certificate from found cert in store
	ErrFailedX509Extract = errors.New("unable to extract x509 from certificate")

	// ErrBadMatchByType represents unknown CERT_MATCH_BY passed
	ErrBadMatchByType = errors.New("cert match by type not implemented")

	// ErrBadCertStore represents unknown CERT_STORE passed
	ErrBadCertStore = errors.New("cert store type not implemented")

	// ErrConflictCertFileAndStore represents ambiguous configuration of both file and store
	ErrConflictCertFileAndStore = errors.New("'cert_file' and 'cert_store' may not both be configured")

View on GitHub (pinned to 3a66a489d2)

Solutions

  1. Verify the certificate's private key is accessible: open certmgr.msc, confirm the key has a private key and the running user/service has read access to it.
  2. Re-import the certificate into the store ensuring the private key is included (PFX import with exportable key) rather than a cert-only import.
  3. Run the process under an account with rights to the key's machine key container, or move the cert to the correct store (LocalMachine vs CurrentUser).
  4. If the key lives on a smartcard/HSM, ensure the corresponding CSP/KSP driver is installed and the token is present.

Example fix

// before: key stored only as public cert, extraction fails
CertStore: "SystemRoot"
// after: import PFX with private key into LocalMachine\My
// certutil -f -p <pass> -importpfx my.pfx
Defensive patterns

Strategy: try-catch

Validate before calling

// Go: before relying on store cert, confirm key is exportable
ctx, err := certstore.AcquireContext("LocalMachine\\My")
if err != nil { log.Fatal(err) }
// certKey failure is environment-side; pre-check private key presence via certutil -repairstore My <thumbprint>

Type guard

func isExtractPropErr(err error) bool { return errors.Is(err, certstore.ErrExtractPropertyFromKey) }

Try / catch

pk, err := cs.TLSConfig(...)
if errors.Is(err, certstore.ErrExtractPropertyFromKey) {
    // fall back to file-based certs or fail startup with a clear message
}

Prevention

When it happens

Trigger: Calling TLSConfig/certSearch on Windows leads to cs.certKey(ctx); certstore_windows.go:783 and :796 return this sentinel when the underlying property-extraction API returns a non-zero r (e.g. extracting the public key from an acquired key context fails).

Common situations: Windows machine/user store certificates whose private key is inaccessible (permission issues, key stored on a smartcard/HSM with no CSP available), corrupted key properties, or certificates where the key provider cannot be resolved by the current process user.

Related errors

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/e601a86fc6cdc7bb. Report an issue: GitHub.