nats-io/nats-server · error

unable to load key from TPM: %v

Error message

unable to load key from TPM: %v

What it means

Wraps an error from readTPMKeysFromFile() in LoadJetStreamEncryptionKeyFromTPM. It fires when the JetStream key file exists but cannot be read or its public/private blobs cannot be parsed (corrupt, truncated, or permission-denied file), so the sealed key cannot be loaded for unsealing.

Source

Thrown at server/tpm/js_ek_tpm_windows.go:272

	defer func() {
		tpm2.FlushContext(rwc, srkHandle)
	}()
	if err != nil {
		return "", fmt.Errorf("unable to regenerate SRK from the TPM: %v", err)
	}
	// Read the keys from the key file. If the filed doesn't exist it means we need to create
	// a new js encrytpion key.
	publicBlob, privateBlob, err := readTPMKeysFromFile(jsKeyFile)
	if err != nil {
		if os.IsNotExist(err) {
			jsek, err := createAndSealJsEncryptionKey(rwc, srkHandle, srkPassword, jsKeyFile, jsKeyPassword, pcr)
			if err != nil {
				return "", fmt.Errorf("unable to generate new key from the TPM: %v", err)
			}
			// we've created and sealed the JS Encryption key, now we just return it.
			return jsek, nil
		}
		return "", fmt.Errorf("unable to load key from TPM: %v", err)
	}

	// Unseal the JetStream encryption key using the TPM.
	jsek, err := unsealJsEncrpytionKey(rwc, pcr, srkHandle, srkPassword, jsKeyPassword, publicBlob, privateBlob)
	if err != nil {
		return "", fmt.Errorf("unable to unseal key from the TPM: %v", err)
	}
	return jsek, nil
}

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Check permissions on jsKeyFile and its containing directory
2. If the file is corrupt, remove it so a fresh key is created and sealed on the next call
3. Verify the file was not truncated or modified since it was written
4. Recreate the JetStream encryption key if blobs cannot be recovered

When it happens

Trigger: Thrown at server/tpm/js_ek_tpm_windows.go:272 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/1f6f1236d8f9a2a4. Report an issue: GitHub.