Fix 0x8009400B CERTSRV_E_NO_VALID_KRA Private Key Archive Error

I know this error can stop you cold — especially when you're in the middle of rolling out certificates or migrating a CA. Let's get it fixed.

Quick Fix: Issue a Key Recovery Agent Certificate

The real fix is simple: you need a valid Key Recovery Agent (KRA) certificate on the CA server. The error 0x8009400B means the CA tried to archive a private key but couldn't find a KRA cert to encrypt it with. Here's the step-by-step.

Open the Certification Authority console on your CA server. Go to Start > Run, type certsrv.msc, hit Enter.
After it opens, you'll see your CA name in the left pane. Right-click it and choose Properties.
Go to the Recovery Agents tab. You should see a list — probably empty. If there's no KRA certificate listed, that's your problem.
Click Add. A dialog will pop up asking you to select an existing KRA certificate. But you probably don't have one. Don't worry — we'll create it next.
Close the Properties window for now (click Cancel). You need to issue a KRA certificate first. Open the Certificate Templates console: Start > Run, type certtmpl.msc, hit Enter.
Find the template named Key Recovery Agent (it's under Certificate Templates in the left pane). Right-click it and choose Duplicate Template.
On the General tab of the new template, give it a name like "KRA - Server 2022" and set the validity period to something reasonable (2 years is typical). Click OK to close.
Now go back to the Certification Authority console. Right-click Certificate Templates under your CA, choose New > Certificate Template to Issue. Select your new KRA template and click OK.
Request the KRA certificate on the CA server itself. Open the Certificates snap-in for the local computer: Start > Run, type certlm.msc, hit Enter.
Right-click Personal > All Tasks > Request New Certificate. Click Next twice until you see the list of templates. Select your new KRA template, click Enroll. You should see "Certificate installed" and a new cert with the Intended Purpose of "Key Recovery Agent" in Personal > Certificates.
Go back to CA Properties > Recovery Agents tab. Click Add. You should now see your KRA certificate listed. Select it and click OK. After clicking Apply, you should see the KRA cert listed with a status of "Valid". Click OK to close.
Restart the Certificate Services to make sure the CA picks up the change. Run net stop certsvc && net start certsvc from an elevated command prompt.
After it restarts, try archiving the private key again. The error should be gone.

Why This Fix Works

The CA uses the KRA certificate to encrypt the private key before storing it in the certificate database. Without a KRA cert, the CA can't encrypt it, so it fails with 0x8009400B. By issuing a KRA certificate and adding it to the CA's recovery agents list, you give the CA the encryption key it needs. It's like handing the CA a lockbox — now it can seal the private key safely.

One thing I've learned the hard way: the KRA certificate must be issued from the same CA that's doing the archiving. Cross-CA KRA certs won't work here. Keep it simple — issue it from the local CA.

Less Common Variations

Sometimes the error appears even after you've added a KRA cert. Here are the gotchas I've seen:

KRA certificate expired. Check the cert's validity date in certlm.msc. If it's expired, you need to renew it and re-add it to the Recovery Agents tab.
Wrong template configuration. The KRA template must have the Archive subject's private key option enabled. Open the template properties in certtmpl.msc, go to the Request Handling tab, and make sure that checkbox is checked.
Multiple KRA certs, but one is invalid. The CA might pick a bad one. In the Recovery Agents tab, remove all KRA certs, then add only the valid one. The CA uses the first valid cert it finds — if a broken one comes first, it fails.
The CA itself doesn't have the private key for the KRA cert. This happens if you imported the KRA cert from another server. The CA needs the private key to encrypt. Issue the cert directly on the CA server to avoid this.

If none of that works, run certutil -repairstore my "CERT_SERIAL_NUMBER" to repair the KRA certificate's private key mapping. Replace the serial number with the one from your KRA cert (find it in the Details tab of the cert).

Prevention for Next Time

The easiest way to dodge this error is to set up the KRA certificate before you start issuing certificates that need archiving. Here's my checklist:

As soon as you install a new CA, issue a KRA certificate and add it to the Recovery Agents tab. Don't wait until you need it.
Set an alert for KRA certificate expiration — 30 days before expiry is a good window. The cert validity can be set to 10 years if you want less hassle.
Test archiving a throwaway certificate after setup. Use a test template with "Archive private key" enabled. If it works, you're golden.
Document the KRA certificate's serial number and location. If you ever migrate the CA, you'll need to know which cert was used.

That's it. You should be past the 0x8009400B error now. If not, check the Event Viewer logs under Applications and Services Logs > Microsoft > Windows > CertificateServices for more clues. But 90% of the time, it's the missing KRA cert.