nats-io/nats-server · error

unable to write keys file to %q: %v

Error message

unable to write keys file to %q: %v

What it means

After successfully JSON-encoding the sealed TPM blobs, writeTPMKeysToFile could not write the keys file at the given path via os.WriteFile. This fires when the target directory was removed between creation and write, the filesystem is full or read-only, permission bits deny writing, or the path is invalid — leaving the server without a persisted JetStream encryption key.

Source

Thrown at server/tpm/js_ek_tpm_windows.go:108

base64.StdEncoding.Encode(tpmKeys.PrivateKey, privateBlob)
base64.StdEncoding.Encode(tpmKeys.PublicKey, publicBlob)
// Convert to JSON
keysJSON, err := json.Marshal(tpmKeys)
if err != nil {
	return fmt.Errorf("unable to marshal keys to JSON: %v", err)
}
// Write the JSON to a file
if err := os.WriteFile(filename, keysJSON, 0640); err != nil {
	return fmt.Errorf("unable to write keys file to %q: %v", filename, err)
}
return nil

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Check disk space and that the filesystem containing the key file is writable
2. Verify the server process has write permission on the key directory (created 0750)
3. Confirm the configured jsKeyFile path is valid and its parent directory exists
4. Fix the underlying OS error (wrapped as %v) and restart so the key is created and sealed again

When it happens

Trigger: Thrown at server/tpm/js_ek_tpm_windows.go:108 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/c11e72a4ae233f80. Report an issue: GitHub.