| Previous | Next |
| CERTSRV_E_NO_VALID_KRA | CERTSRV_E_NO_CAADMIN_DEFINED |
CERTSRV_E_BAD_REQUEST_KEY_ARCHIVAL
CERTSRV_E_BAD_REQUEST_KEY_ARCHIVAL The request includes an archived private key in an invalid CMS request structure. The CA expects the encrypted private key in an unauthenticated attribute on the outermost signature.
What to check
- Regenerate the request with supported enrollment tooling rather than editing the encoded request manually.
- Confirm that the request was created for a template that requires key archival and that the CA has valid Key Recovery Agent configuration.
- If a custom enrollment client is used, validate its PKCS#7/CMS request construction against the AD CS enrollment protocol requirements.
Microsoft: Key Recovery Server
Microsoft: Active Directory Certificate Services overview
Looking for a different code? Search another status or error code.