nats-io/nats-server · error

unable to generate new key from the TPM: %v

Error message

unable to generate new key from the TPM: %v

What it means

Wraps an error from createAndSealJsEncryptionKey() in LoadJetStreamEncryptionKeyFromTPM. Reached when the JetStream key file does not exist and a new key must be created and sealed against the SRK; it fires if key generation, sealing, or writing the public/private blobs to jsKeyFile fails.

Source

Thrown at server/tpm/js_ek_tpm_windows.go:267

	}
	defer rwc.Close()

	// Load the key from the TPM
	srkHandle, err := regenerateSRK(rwc, srkPassword)
	defer func() {
		tpm2.FlushContext(rwc, srkHandle)
	}()
	if err != nil {
		return "", fmt.Errorf("unable to regenerate SRK from the TPM: %v", err)
	}
	// Read the keys from the key file. If the filed doesn't exist it means we need to create
	// a new js encrytpion key.
	publicBlob, privateBlob, err := readTPMKeysFromFile(jsKeyFile)
	if err != nil {
		if os.IsNotExist(err) {
			jsek, err := createAndSealJsEncryptionKey(rwc, srkHandle, srkPassword, jsKeyFile, jsKeyPassword, pcr)
			if err != nil {
				return "", fmt.Errorf("unable to generate new key from the TPM: %v", err)
			}
			// we've created and sealed the JS Encryption key, now we just return it.
			return jsek, nil
		}
		return "", fmt.Errorf("unable to load key from TPM: %v", err)
	}

	// Unseal the JetStream encryption key using the TPM.
	jsek, err := unsealJsEncrpytionKey(rwc, pcr, srkHandle, srkPassword, jsKeyPassword, publicBlob, privateBlob)
	if err != nil {
		return "", fmt.Errorf("unable to unseal key from the TPM: %v", err)
	}
	return jsek, nil
}

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Check disk permissions and space for the directory containing jsKeyFile
2. Verify the TPM can perform key creation and sealing operations
3. Confirm srkHandle and srkPassword are valid for sealing
4. Delete any partially written key file and retry creation

When it happens

Trigger: Thrown at server/tpm/js_ek_tpm_windows.go:267 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/4bfb359119e6e18e. Report an issue: GitHub.