HRESULT 0x80095004 (XENROLL_E_RESPONSE_KA_HASH

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

There is a key archival hash mismatch between the request and the response.

Previous	Next
XENROLL_E_RESPONSE_UNEXPECTED_KA_HASH	XENROLL_E_KEYSPEC_SMIME_MISMATCH

XENROLL_E_RESPONSE_KA_HASH_MISMATCH

The important part of XENROLL_E_RESPONSE_KA_HASH_MISMATCH is its scope: key-archival integrity binding. The hash returned by the CA does not match the encrypted private-key material that the client submitted for archival. Keep the hexadecimal value 0x80095004 with the returning API, because higher-level software may translate it into a message that loses this distinction.

What the code establishes

In the path, CMC key archival binds encrypted private-key material in the request to metadata returned by the CA. Preserve the original request, encrypted-key blob, archive-key hash attribute, response, and request identity as one transaction in a key-archival integrity binding investigation. Rebuilding the request changes the value being bound.

Facts to preserve before changing state

1. CMC request and response bytes plus request or transaction identifier
Recompute and compare the encoded encrypted-key hash using the original request bytes.
2. Encrypted private-key blob and archive-key-hash attribute presence and value
Check for response/request mix-up, re-encoding, proxy transformation, or incorrect CA exchange certificate.
3. CA configuration, archival certificate, hash algorithm, and client object state
Treat the mismatch as an integrity failure and do not install the response automatically.

For key-archival integrity binding, these observations are deliberately nonsecret: identifiers, lengths, provider names, policy selections, and state transitions usually support comparison without recording private keys, passwords, PINs, or plaintext.

What to include in an escalation package

CertEnroll holds state across key creation, request encoding, submission, response parsing, and installation. Keep those stages tied to the same client object and key., if the application silently creates a replacement key or reconstructs the request, a later success no longer tests the archival, export, usage, or trust-store condition that originally failed.

Provider and nonsecret key properties captured before request initialization in a key-archival integrity binding investigation.
In the path, original encoded request and response plus transaction or request identifiers.
In the path, CertEnroll method sequence, template or extension choices, and the store targeted during installation.

Isolation procedure

Create one known-good archival request and verify the returned binding before changing CA or client configuration. Then compare attribute presence and hash inputs with the failing transaction byte for byte.

Preserve the original input, identity, provider or protocol selection, and first return Value.
Use one known-good control that changes only the suspected part of the key-archival integrity binding path.
reverse the comparison with known-good input on the failing layer where that can be done safely.
Record where behavior first diverges in the key-archival integrity binding path instead of judging only by the final application message.

Common wrong turns

This is stronger than a missing attribute: both sides supplied a value, but they do not bind to the same archived key. Do not disable key archival or ignore the response attribute merely to obtain a certificate; that can issue a certificate whose private key was not recoverably archived as policy requires.

For key-archival integrity binding, keep the original request and response pair; regenerating a key or submitting a new request may succeed while bypassing the policy or transaction state that produced this HRESULT.

Proving the intended path works

In the path, the CA response must carry exactly the expected binding for the encrypted key in the same request, and the client must validate it before accepting enrollment. Keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.

Technical references

These sources define the HRESULT and the relevant key-archival integrity binding interface, protocol, or data format.

Looking for a different code? Search another status or error code.