What does HRESULT 0x80095000 (XENROLL_E_KEY_NOT_EXPORTABLE) mean?

XENROLL_E_KEY_NOT_EXPORTABLE

XENROLL_E_KEY_NOT_EXPORTABLE should be read at the private-key export policy boundary. The enrollment workflow attempted to export or package a private key whose provider policy marks it nonexportable or hardware-bound. The useful diagnostic question is which concrete object and operation caused Windows to select this exact HRESULT—not whether a key, certificate, account, file, or device merely “works.”

Locate the first failing boundary

CertEnroll is coordinating request construction with a private key owned by a CSP, KSP, or hardware device in a private-key export policy investigation. Exportability, key specification, intended usage, and provider policy are established before or during key creation and cannot always be changed after the key exists.

Useful observations, not generic logs

Code-specific checks:

• Inspect export policy before key creation and identify whether the key is in a CSP, CNG KSP, TPM, smart card, or HSM.
• Determine whether the operation really needs private-key export or only signing/decryption through the provider.
• Create a replacement key with approved export policy only when organizational security requirements permit it.

What to include in an escalation package

CertEnroll holds state across key creation, request encoding, submission, response parsing, and installation. Keep those stages tied to the same client object and key., if the application silently creates a replacement key or reconstructs the request, a later success no longer tests the archival, export, usage, or trust-store condition that originally failed.

• Provider and nonsecret key properties captured before request initialization in this condition investigation.
• In the path, original encoded request and response plus transaction or request identifiers.
• In the path, CertEnroll method sequence, template or extension choices, and the store targeted during installation.

Reproduction without destructive cleanup

Create a disposable key with explicitly chosen policy and build a minimal request that uses it in this condition investigation. Compare with the production key without exporting secret material. This identifies creation-time policy versus request metadata.

1. Preserve the original input, identity, provider or protocol selection, and first return Value.
2. Use one known-good control that changes only the suspected part of this path.
3. Reverse the comparison with known-good input on the failing layer where that can be done safely.
4. Record where behavior first diverges in this path instead of judging only by the final application message.

How this differs from similar failures

Changing certificate permissions does not make a nonexportable private key exportable., marking a replacement key exportable or changing KeySpec only to pass enrollment can violate the original protection and usage requirements.

Keep the original request and response pair; regenerating a key or submitting a new request may succeed while bypassing the policy or transaction state that produced this HRESULT.

Regression check

The intended key policy and request semantics must agree, and the issued certificate must reference the same key with the required usage and protection. Keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.

Technical references

These sources define the HRESULT and the relevant relevant interface, protocol, or data format.

• Microsoft Open Specifications: HRESULT values.
• Microsoft: IX509CertificateRequestCmc.
• Microsoft: CNG Key Storage Providers.
• RFC 5280: Internet X.509 PKI profile.

Looking for a different code? Search another status or error code.