nats-io/nats-server · error

unable to unseal key from the TPM: %v

Error message

unable to unseal key from the TPM: %v

What it means

Wraps an error from unsealing the JetStream encryption key inside LoadJetStreamEncryptionKeyFromTPM. It fires when the TPM refuses to unseal the stored blobs, most often because jsKeyPassword or the PCR value does not match those used at seal time, or the sealed object is corrupt.

Source

Thrown at server/tpm/js_ek_tpm_windows.go:278

	// Read the keys from the key file. If the filed doesn't exist it means we need to create
	// a new js encrytpion key.
	publicBlob, privateBlob, err := readTPMKeysFromFile(jsKeyFile)
	if err != nil {
		if os.IsNotExist(err) {
			jsek, err := createAndSealJsEncryptionKey(rwc, srkHandle, srkPassword, jsKeyFile, jsKeyPassword, pcr)
			if err != nil {
				return "", fmt.Errorf("unable to generate new key from the TPM: %v", err)
			}
			// we've created and sealed the JS Encryption key, now we just return it.
			return jsek, nil
		}
		return "", fmt.Errorf("unable to load key from TPM: %v", err)
	}

	// Unseal the JetStream encryption key using the TPM.
	jsek, err := unsealJsEncrpytionKey(rwc, pcr, srkHandle, srkPassword, jsKeyPassword, publicBlob, privateBlob)
	if err != nil {
		return "", fmt.Errorf("unable to unseal key from the TPM: %v", err)
	}
	return jsek, nil
}

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Verify jsKeyPassword matches the password used when the key was sealed
2. Confirm the PCR value has not changed since sealing (e.g. after firmware or boot-chain updates)
3. If PCR policy changed, re-seal the key under the new PCR value
4. If blobs are corrupt, delete jsKeyFile and create a new sealed key

When it happens

Trigger: Thrown at server/tpm/js_ek_tpm_windows.go:278 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/551899252d229343. Report an issue: GitHub.