| Previous | Next |
| XENROLL_E_RESPONSE_KA_HASH_MISMATCH | TRUST_E_SYSTEM_ERROR |
XENROLL_E_KEYSPEC_SMIME_MISMATCH
XENROLL_E_KEYSPEC_SMIME_MISMATCH identifies a failure in key usage versus S/MIME extension. The requested signing key specification conflicts with S/MIME-related certificate extension or template semantics expected by the enrollment component. Diagnose key usage versus S/MIME extension at the first component that returned the value, not the last user-interface layer that displayed it; later cleanup and fallback attempts can produce different secondary errors.
Locate the first failing boundary
CertEnroll is coordinating request construction with a private key owned by a CSP, KSP, or hardware device in a key usage versus S/MIME extension investigation. Exportability, key specification, intended usage, and provider policy are established before or during key creation and cannot always be changed after the key exists.
Useful observations, not generic logs
- Provider, key name, algorithm, key specification, export policy, and hardware backing
Record KeySpec, key usage, EKU, SMIME capabilities extension, provider type, and template.
Shows how client request state is bound to key or CA response state. - Template or extension values describing signing, encryption, or S/MIME use
Check whether the certificate is intended for signing, key exchange/encryption, or both.
Separates local key policy from certificate and trust-store decisions. - The CertEnroll object state and API call at which policy becomes inconsistent
Use a template and key specification whose intended cryptographic roles agree.
In the path, protects private-key and archival evidence while testing configuration.
Preserve the evidence chain
CertEnroll holds state across key creation, request encoding, submission, response parsing, and installation. Keep those stages tied to the same client object and key. If the application silently creates a replacement key or reconstructs the request, a later success no longer tests the archival, export, usage, or trust-store condition that originally failed in a key usage versus S/MIME extension investigation.
- Provider and nonsecret key properties captured before request initialization in a key usage versus S/MIME extension investigation.
- In the path, original encoded request and response plus transaction or request identifiers.
- In the path, CertEnroll method sequence, template or extension choices, and the store targeted during installation.
Reproduction without destructive cleanup
Create a disposable key with explicitly chosen policy and build a minimal request that uses it in a key usage versus S/MIME extension investigation. Compare with the production key without exporting secret material. This identifies creation-time policy versus request metadata.
| Test | Interpretation |
|---|---|
| Same input, known-good path | For key usage versus S/MIME extension, success moves attention toward the selected provider, policy, device, context, or transaction state. |
| Known-good input, failing path | For key usage versus S/MIME extension, failure suggests that the environment or selected object is independently unable to perform the operation. |
| Original path after one isolated change | For key usage versus S/MIME extension, this comparison demonstrates whether the proposed correction addresses the original condition. |
How this differs from similar failures
Changing the display name or certificate store will not resolve a semantic mismatch between key purpose and extension content., marking a replacement key exportable or changing KeySpec only to pass enrollment can violate the original protection and usage requirements.
For key usage versus S/MIME extension, keep the original request and response pair; regenerating a key or submitting a new request may succeed while bypassing the policy or transaction state that produced this HRESULT.
Regression check
The intended key policy and request semantics must agree, and the issued certificate must reference the same key with the required usage and protection. Keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.
Technical references
These sources define the HRESULT and the relevant key usage versus S/MIME extension interface, protocol, or data format.
- Microsoft Open Specifications: HRESULT values.
- Microsoft: IX509CertificateRequestCmc.
- Microsoft: CNG Key Storage Providers.
- RFC 5280: Internet X.509 PKI profile.
Looking for a different code? Search another status or error code.