| Previous | Next |
| FVE_E_POLICY_CONFLICT_RDV_RP_OFF_ADB_ON | FVE_E_PRIVATEKEY_AUTH_FAILED |
FVE_E_NON_BITLOCKER_KU
Key Usage and EKU are independent checks
FVE_E_NON_BITLOCKER_KU means the X.509 Key Usage extension is present but does not allow the cryptographic operation BitLocker requires. For BitLocker recovery certificates, Microsoft documents data encipherment-related usage requirements; a correct BitLocker EKU alone does not override an incompatible Key Usage bitmask.
This is distinct from FVE_E_NON_BITLOCKER_OID. Key Usage describes allowed cryptographic operations, while Extended Key Usage describes application purposes. Both can constrain the same certificate.
What to verify
- Inspect the raw Key Usage and EKU extensions, not only the friendly names displayed by a certificate console.
- Compare the certificate template with BitLocker policy and the protector method being created.
- Confirm that the certificate includes an accessible private key when the workflow requires decryption.
- Reissue from a corrected template; changing local trust does not add missing Key Usage permissions.
References
- Microsoft: BitLocker recovery overview
- Microsoft: certificate protector API
- RFC 5280: Key Usage and Extended Key Usage
Looking for a different code? Search another status or error code.