What does HRESULT 0x80095002 (XENROLL_E_RESPONSE_KA_HASH_NOT_FOUND) mean?

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

The key archival hash attribute was not found in the response.

Previous	Next
XENROLL_E_CANNOT_ADD_ROOT_CERT	XENROLL_E_RESPONSE_UNEXPECTED_KA_HASH

XENROLL_E_RESPONSE_KA_HASH_NOT_FOUND

XENROLL_E_RESPONSE_KA_HASH_NOT_FOUND identifies a failure in key-archival response binding. A key-archival enrollment expected the CA response to carry the authenticated encrypted-key hash, but that binding attribute is missing. Diagnose key-archival response binding at the first component that returned the value, not the last user-interface layer that displayed it; later cleanup and fallback attempts can produce different secondary errors.

Read the failure at the correct layer

In the path, CMC key archival binds encrypted private-key material in the request to metadata returned by the CA. Preserve the original request, encrypted-key blob, archive-key hash attribute, response, and request identity as one transaction in a key-archival response binding investigation. Rebuilding the request changes the value being bound.

Build an incident record

CMC request and response bytes plus request or transaction identifier
Confirm that the request was a CMC key-archival request and that the template/CA supports archival.
Shows how client request state is bound to key or CA response state.
Encrypted private-key blob and archive-key-hash attribute presence and value
Inspect the CMC controls and authenticated attributes in both request and response.
Separates local key policy from certificate and trust-store decisions.
CA configuration, archival certificate, hash algorithm, and client object state
Verify that no proxy or conversion step replaced the original enrollment response.
In the path, protects private-key and archival evidence while testing configuration.

Build a timeline before changing state

In the path, CertEnroll holds state across key creation, request encoding, submission, response parsing, and installation. Keep those stages tied to the same client object and key. If the application silently creates a replacement key or reconstructs the request, a later success no longer tests the archival, export, usage, or trust-store condition that originally failed.

Provider and nonsecret key properties captured before request initialization in a key-archival response binding investigation.
In the path, original encoded request and response plus transaction or request identifiers.
In the path, CertEnroll method sequence, template or extension choices, and the store targeted during installation.

Use two comparison axes

Create one known-good archival request and verify the returned binding before changing CA or client configuration. Then compare attribute presence and hash inputs with the failing transaction byte for byte.

Preserve the original input, identity, provider or protocol selection, and first return Value.
Use one known-good control that changes only the suspected part of the key-archival response binding path.
reverse the comparison with known-good input on the failing layer where that can be done safely.
Record where behavior first diverges in the key-archival response binding path instead of judging only by the final application message.

Do not collapse it into a neighboring code

The certificate may be otherwise parseable, but the client cannot prove that the response corresponds to the archived private key. Do not disable key archival or ignore the response attribute merely to obtain a certificate; that can issue a certificate whose private key was not recoverably archived as policy requires.

For key-archival response binding, keep the original request and response pair; regenerating a key or submitting a new request may succeed while bypassing the policy or transaction state that produced this HRESULT.

Verification after the change

In the path, the CA response must carry exactly the expected binding for the encrypted key in the same request, and the client must validate it before accepting enrollment. Keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.

Technical references

These sources define the HRESULT and the relevant key-archival response binding interface, protocol, or data format.

Looking for a different code? Search another status or error code.