| Previous | Next |
| CERTSRV_E_PENDING_CLIENT_RESPONSE | XENROLL_E_CANNOT_ADD_ROOT_CERT |
XENROLL_E_KEY_NOT_EXPORTABLE
XENROLL_E_KEY_NOT_EXPORTABLE should be read at the private-key export policy boundary. The enrollment workflow attempted to export or package a private key whose provider policy marks it nonexportable or hardware-bound. The useful diagnostic question is which concrete object and operation caused Windows to select this exact HRESULT—not whether a key, certificate, account, file, or device merely “works.”
Locate the first failing boundary
CertEnroll is coordinating request construction with a private key owned by a CSP, KSP, or hardware device in a private-key export policy investigation. For XENROLL_E_KEY_NOT_EXPORTABLE, exportability, key specification, intended usage, and provider policy are established before or during key creation and cannot always be changed after the key exists.
Useful observations, not generic logs
| Record | Why it matters for this code |
|---|---|
| Provider, key name, algorithm, key specification, export policy, and hardware backing | Shows how client request state is bound to key or CA response state when XENROLL_E_KEY_NOT_EXPORTABLE is returned. |
| Template or extension values describing signing, encryption, or S/MIME use | Separates local key policy from certificate and trust-store decisions when XENROLL_E_KEY_NOT_EXPORTABLE is returned. |
| The CertEnroll object state and API call at which policy becomes inconsistent | In the XENROLL_E_KEY_NOT_EXPORTABLE path, protects private-key and archival evidence while testing configuration. |
Code-specific checks:
- Inspect export policy before key creation and identify whether the key is in a CSP, CNG KSP, TPM, smart card, or HSM.
- Determine whether the operation really needs private-key export or only signing/decryption through the provider.
- Create a replacement key with approved export policy only when organizational security requirements permit it.
What to include in an escalation package
For XENROLL_E_KEY_NOT_EXPORTABLE, CertEnroll holds state across key creation, request encoding, submission, response parsing, and installation. Keep those stages tied to the same client object and key. In the XENROLL_E_KEY_NOT_EXPORTABLE path, if the application silently creates a replacement key or reconstructs the request, a later success no longer tests the archival, export, usage, or trust-store condition that originally failed.
- Provider and nonsecret key properties captured before request initialization in this condition investigation.
- In the XENROLL_E_KEY_NOT_EXPORTABLE path, original encoded request and response plus transaction or request identifiers.
- In the XENROLL_E_KEY_NOT_EXPORTABLE path, CertEnroll method sequence, template or extension choices, and the store targeted during installation.
Reproduction without destructive cleanup
Create a disposable key with explicitly chosen policy and build a minimal request that uses it in this condition investigation. For XENROLL_E_KEY_NOT_EXPORTABLE, compare with the production key without exporting secret material. This identifies creation-time policy versus request metadata when XENROLL_E_KEY_NOT_EXPORTABLE is returned.
- Preserve the original input, identity, provider or protocol selection, and first return value for
XENROLL_E_KEY_NOT_EXPORTABLE. - Use one known-good control that changes only the suspected part of this path.
- Reverse the comparison with known-good input on the failing layer where that can be done safely.
- Record where behavior first diverges in this path instead of judging only by the final application message.
How this differs from similar failures
Changing certificate permissions does not make a nonexportable private key exportable. In the XENROLL_E_KEY_NOT_EXPORTABLE path, marking a replacement key exportable or changing KeySpec only to pass enrollment can violate the original protection and usage requirements.
Keep the original request and response pair; regenerating a key or submitting a new request may succeed while bypassing the policy or transaction state that produced this HRESULT.
Regression check
For XENROLL_E_KEY_NOT_EXPORTABLE, the intended key policy and request semantics must agree, and the issued certificate must reference the same key with the required usage and protection. Keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.
Technical references
These sources define the HRESULT and the relevant relevant interface, protocol, or data format.
- Microsoft Open Specifications: HRESULT values.
- Microsoft: IX509CertificateRequestCmc.
- Microsoft: CNG Key Storage Providers.
- RFC 5280: Internet X.509 PKI profile.
Looking for a different code? Search another status or error code.