| Previous | Next |
| CERTSRV_E_PENDING_CLIENT_RESPONSE | XENROLL_E_CANNOT_ADD_ROOT_CERT |
XENROLL_E_KEY_NOT_EXPORTABLE
XENROLL_E_KEY_NOT_EXPORTABLE should be read at the private-key export policy boundary. The enrollment workflow attempted to export or package a private key whose provider policy marks it nonexportable or hardware-bound. Inspect the selected CSP or KSP, key export policy, hardware binding, and enrollment request before attempting to package or archive the private key.
Locate the first failing stage
CertEnroll is coordinating request construction with a private key owned by a CSP, KSP, or hardware device in a private-key export policy investigation. Exportability, key specification, intended usage, and provider policy are established before or during key creation and cannot always be changed after the key exists.
Useful observations, not generic logs
| Record | Why it matters for this code |
|---|---|
| Provider, key name, algorithm, key specification, export policy, and hardware backing | Shows how client request state is bound to key or CA response state. |
| Template or extension values describing signing, encryption, or S/MIME use | Separates local key policy from certificate and trust-store decisions. |
| The CertEnroll object state and API call at which policy becomes inconsistent | Protects private-key and archival evidence while testing configuration. |
Code-specific checks:
- Inspect export policy before key creation and identify whether the key is in a CSP, CNG KSP, TPM, smart card, or HSM.
- Determine whether the operation really needs private-key export or only signing/decryption through the provider.
- Create a replacement key with approved export policy only when organizational security requirements permit it.
What to include in an escalation package
CertEnroll holds state across key creation, request encoding, submission, response parsing, and installation. Keep those stages tied to the same client object and key. If the application silently creates a replacement key or reconstructs the request, a later success no longer tests the archival, export, usage, or trust-store condition that originally failed.
- Provider and nonsecret key properties captured before request initialization in this condition investigation.
- Original encoded request and response plus transaction or request identifiers.
- CertEnroll method sequence, template or extension choices, and the store targeted during installation.
Reproduction without destructive cleanup
Create a disposable key with explicitly chosen policy and build a minimal request that uses it in this condition investigation. Compare with the production key without exporting secret material. This identifies creation-time policy versus request metadata.
- Use one known-good control that changes only the suspected part of this path.
- Record where behavior first diverges in this path instead of judging only by the final application message.
How this differs from similar failures
Changing certificate permissions does not make a nonexportable private key exportable. Marking a replacement key exportable or changing KeySpec only to pass enrollment can violate the original protection and usage requirements.
Regression check
The intended key policy and request semantics must agree, and the issued certificate must reference the same key with the required usage and protection.
Technical references
These sources define the HRESULT and the relevant interface, protocol, or data format.
Looking for a different code? Search another status or error code.