| Previous | Next |
| XENROLL_E_RESPONSE_KA_HASH_NOT_FOUND | XENROLL_E_RESPONSE_KA_HASH_MISMATCH |
XENROLL_E_RESPONSE_UNEXPECTED_KA_HASH
XENROLL_E_RESPONSE_UNEXPECTED_KA_HASH should be read at the unexpected key-archival metadata boundary. The CA response contains a key-archival hash even though the client did not establish a matching archival transaction state. For unexpected key-archival metadata, the useful diagnostic question is which concrete object and operation caused Windows to select this exact HRESULT—not whether a key, certificate, account, file, or device merely “works.”
Start with the returning API
In the path, CMC key archival binds encrypted private-key material in the request to metadata returned by the CA. Preserve the original request, encrypted-key blob, archive-key hash attribute, response, and request identity as one transaction in an unexpected key-archival metadata investigation. Rebuilding the request changes the value being bound.
Diagnostic evidence matrix
| Record | Why it matters for this code |
|---|---|
| CMC request and response bytes plus request or transaction identifier | Shows how client request state is bound to key or CA response state. |
| encrypted private-key blob and archive-key-hash attribute presence and value | Separates local key policy from certificate and trust-store decisions. |
| CA configuration, archival certificate, hash algorithm, and client object state | In the path, protects private-key and archival evidence while testing configuration. |
Code-specific checks:
- Check whether the wrong response was paired with the request or whether stale enrollment state was reused.
- Inspect ArchivePrivateKey and KeyArchivalCertificate settings on the CMC request.
- Correlate the response with its request ID and encrypted-key hash before accepting it.
Correlate the failure with state changes
CertEnroll holds state across key creation, request encoding, submission, response parsing, and installation in an unexpected key-archival metadata investigation. Keep those stages tied to the same client object and key. If the application silently creates a replacement key or reconstructs the request, a later success no longer tests the archival, export, usage, or trust-store condition that originally failed.
- Provider and nonsecret key properties captured before request initialization in an unexpected key-archival metadata investigation.
- In the path, original encoded request and response plus transaction or request identifiers.
- In the path, CertEnroll method sequence, template or extension choices, and the store targeted during installation.
Minimal test sequence
Create one known-good archival request and verify the returned binding before changing CA or client configuration. Then compare attribute presence and hash inputs with the failing transaction byte for byte.
| Test | Interpretation |
|---|---|
| Same input, known-good path | For unexpected key-archival metadata, success moves attention toward the selected provider, policy, device, context, or transaction state. |
| Known-good input, failing path | For unexpected key-archival metadata, failure suggests that the environment or selected object is independently unable to perform the operation. |
| Original path after one isolated change | For unexpected key-archival metadata, this comparison demonstrates whether the proposed correction addresses the original condition. |
Boundaries of this HRESULT
Ignoring the unexpected attribute can bind a certificate response to the wrong archival operation. Do not disable key archival or ignore the response attribute merely to obtain a certificate; that can issue a certificate whose private key was not recoverably archived as policy requires.
For unexpected key-archival metadata, keep the original request and response pair; regenerating a key or submitting a new request may succeed while bypassing the policy or transaction state that produced this HRESULT.
Closure criteria
In the path, the CA response must carry exactly the expected binding for the encrypted key in the same request, and the client must validate it before accepting enrollment. Keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.
Technical references
These sources define the HRESULT and the relevant unexpected key-archival metadata interface, protocol, or data format.
- Microsoft Open Specifications: HRESULT values.
- Microsoft: CMC Key Archival Request.
- Microsoft: IX509AttributeArchiveKeyHash.
- RFC 5652: Cryptographic Message Syntax.
Looking for a different code? Search another status or error code.