nats-io/nats-server · error

unable to get policy: %v

Error message

unable to get policy: %v

What it means

policyPCRPasswordSession failed while createAndSealJsEncryptionKey was setting up the authorization policy for sealing a new JetStream key. The TPM rejected one of the policy session steps (StartAuthSession, PolicyPCR, PolicyPassword, or PolicyGetDigest), so no new key can be sealed — typically a TPM device error, unsupported algorithm, or bad PCR index.

Source

Thrown at server/tpm/js_ek_tpm_windows.go:150

func createAndSealJsEncryptionKey(rwc io.ReadWriteCloser, srkHandle tpmutil.Handle, srkPassword, jsKeyFile, jsKeyPassword string, pcr int) (string, error) {
	// Get the authorization policy that will protect the data to be sealed
	sessHandle, policy, err := policyPCRPasswordSession(rwc, pcr)
	if err != nil {
		return "", fmt.Errorf("unable to get policy: %v", err)
	}
	if err := tpm2.FlushContext(rwc, sessHandle); err != nil {
		return "", fmt.Errorf("unable to flush session: %v", err)
	}
	// Seal the data to the parent key and the policy
	user, err := nkeys.CreateUser()
	if err != nil {
		return "", fmt.Errorf("unable to create seed: %v", err)
	}
	jsStoreKey, err := user.Seed()
	if err != nil {
		return "", fmt.Errorf("unable to get seed: %v", err)
	}
	privateArea, publicArea, err := tpm2.Seal(rwc, srkHandle, srkPassword, jsKeyPassword, policy, jsStoreKey)
	if err != nil {
		return "", fmt.Errorf("unable to seal data: %v", err)
	}
	return string(jsStoreKey), nil
}

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Check the wrapped error from policyPCRPasswordSession to identify the failing TPM command
2. Verify the configured PCR index is valid (0-23) for the SHA-256 bank
3. Confirm the TPM device is healthy and responsive (e.g. tpm2_getcap)
4. Retry after resolving the TPM error; the key creation will be attempted again on next start

When it happens

Trigger: Thrown at server/tpm/js_ek_tpm_windows.go:150 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/7436e18026850ca0. Report an issue: GitHub.