| Previous | Next |
| CRYPT_E_NO_MATCH | CRYPT_E_NO_KEY_PROPERTY |
CRYPT_E_UNEXPECTED_MSG_TYPE
CRYPT_E_UNEXPECTED_MSG_TYPE identifies a failure in certificate/private-key association during message processing. The caller expected a certificate context or encoded message property suitable for an operation involving a private key, but the selected object does not carry that association. Diagnose certificate/private-key association during message processing at the first component that returned the value, not the last user-interface layer that displayed it; later cleanup and fallback attempts can produce different secondary errors.
What the code establishes
The selected certificate or message context does not expose the private-key association required by the requested operation. Certificate bytes can be perfectly valid while the local context lacks a key-provider property, points to an unavailable key, or represents a certificate imported without private material.
Facts to preserve before changing state
- Certificate thumbprint and store location plus the private-key provider information property
Log the certificate thumbprint, store, provider information, and message operation.
Locates the first cryptographic or representation boundary that fails. - Provider, container or key name, user or machine scope, and caller identity
Use CryptAcquireCertificatePrivateKey or certificate property inspection to confirm a private-key link exists.
Separates object identity and binary structure from later trust policy. - The operation that selected the certificate and whether selection required a private key
Distinguish a certificate-only import from a PFX or enrollment result that should include key material.
Provides a known-good control without rewriting production evidence.
What to include in an escalation package
Preserve the path from source artifact to the byte sequence or object passed into the Windows cryptographic API. Record file acquisition, transport decoding, object selection, structure identifier, provider selection, and the exact call that first rejects the data. This prevents later trust or certificate errors from being mistaken for the original representation or lookup failure.
- The untouched artifact or a reproducible nonsecret sample with a cryptographic hash for identity.
- the API structure type, encoding flags, object or certificate selector, and caller identity.
- Independent decode, lookup, or signature observations that do not modify the original evidence.
Isolation procedure
Use certificate APIs to determine whether the exact context can acquire its private key under the same identity. Compare with a known certificate that has a usable local key, without changing message data or trust policy.
- Use one known-good control that changes only the suspected part of the certificate/private-key association during message processing path.
- Record where behavior first diverges in the certificate/private-key association during message processing path instead of judging only by the final application message.
Common wrong turns
Do not generate a new key until you know whether the wrong certificate was selected or the original association was lost. Reimporting the public certificate alone cannot create the missing private-key association. Protect and locate the original key before altering stores in a certificate/private-key association during message processing investigation.
For certificate/private-key association during message processing, keep representation, cryptographic execution, and trust evaluation separate.
Proving the intended path works
The selected certificate context must acquire the intended private key and complete the operation under the production identity; choosing another certificate is only isolation evidence.
Technical references
These sources define the HRESULT and the relevant certificate/private-key association during message processing interface, protocol, or data format.
Looking for a different code? Search another status or error code.