What does HRESULT 0xC00E006B (MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED) mean?

MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED

What this result actually narrows down

Applications should keep MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED attached to the exact MSMQ call that produced it; translating it immediately to “queue error” discards the diagnostic boundary. The result marks CSP/provider is outside MSMQ supported set. A provider can exist in Windows yet be incompatible with MSMQ message-signing/encryption expectations.

For MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED, authenticated MSMQ messages combine a sender identity, certificate, private key, hash/signature algorithm, and queue policy. When diagnosing MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED, successful certificate parsing does not prove that the key is accessible to the sending process.

When diagnosing MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED, encryption capability and message authentication are related but distinct. In the MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED path, preserve provider, algorithm, certificate, key-container, and queue authentication/privacy settings rather than collapsing them into one “SSL” diagnosis.

MSMQ objects involved

When diagnosing MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED, queue ACLs, certificate trust, private-key access, provider support, and destination authentication policy are independent. Test the layer named by the evidence. For MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED, the code-specific boundary is CSP/provider is outside MSMQ supported set.

Triage data

• Whether the failure occurred while preparing, sending, storing, or validating the message; associate it explicitly with MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED.
• When diagnosing MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED, certificate store location and security identity used by the process; capture the value before cleanup or retry changes it.
• In the MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED path, provider name/type, hash algorithm, and privacy/authentication properties; compare it with a known-good call using the same account and queue type.
• For this MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED result, record the queue path or format name, local/remote placement, transactional flag, caller SID, process build, and UTC correlation ID when they apply.

For MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED, log certificate thumbprints, provider names, SIDs, GUIDs, lengths, and hashes where useful, but do not log private keys, symmetric keys, credentials, or confidential message bodies.

A safe investigation order

1. Record the unsigned HRESULT, MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED, and the native API or COM method before a framework replaces it with a generic exception.
2. Reproduce with the smallest queue/message/property set that still returns MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED; change one precondition at a time.
3. In the MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED path, verify the postcondition after the failed call: queue existence, message presence, directory object state, transaction outcome, or generated output may differ by result.
4. For this MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED result, capture whether the failure occurred while preparing, sending, storing, or validating the message.
5. For MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED, capture certificate store location and security identity used by the process.
6. When diagnosing MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED, apply the code-specific recovery rule: Select a documented provider and algorithm pair; do not merely install another certificate.

Correct response

Select a documented provider and algorithm pair; do not merely install another certificate.

When diagnosing MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED, do not hide this HRESULT behind an unlimited framework retry. In the MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED path, require a verified precondition change and preserve the original correlation identifier across the next attempt.

What this code is not

In the MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED path, authentication failure is not synonymous with queue access denial. For this MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED result, certificate stores, private keys, providers, signatures, and queue policy must be tested separately. The specific focus for MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED remains CSP/provider is outside MSMQ supported set.

• In the MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED path, granting broad queue or certificate permissions may mask the symptom while creating a security defect. For this MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED result, test the exact identity and access needed by the operation.
• For this MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED result, changing queue names, deleting directory objects, or recreating certificates without reconciliation can create a second object while callers still reference the first.

Example failure path

A certificate-registration utility encounters MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED. For MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED, it tests store and private-key access under the production identity before changing queue security. When diagnosing MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED, the acceptance test then changes only the decisive precondition and confirms both the HRESULT and the actual queue/message state.

For MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED, include a negative test for the nearest misleading diagnosis so monitoring and user guidance do not collapse distinct MSMQ failures into one alert.

Technical references

• IETF RFC 5280: Internet X.509 PKI certificate profile — source used for the MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED analysis.
• Microsoft: Message Queuing error and information codes — source used for the MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED analysis.
• Microsoft: authenticated MSMQ message with an external certificate — source used for the MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED analysis.
• Microsoft: MSMQMessage object and message properties — source used for the MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED analysis.
• Microsoft: Windows certificate stores — source used for the MQ_ERROR_ENCRYPTION_PROVIDER_NOT_SUPPORTED analysis.

Looking for a different code? Search another status or error code.