Fix CERTSRV_E_ARCHIVED_KEY_REQUIRED 0X80094804
This error means the CA needs your private key for recovery, but you didn't mark it for export. I'll show you how to fix it fast.
Quick Answer
Run certreq -new request.inf request.req with the Exportable flag set to TRUE and the KeyArchival attribute included, or switch to a certificate template that supports key archival.
What's Going On?
This error shows up when you try to get a certificate from a Windows CA (Active Directory Certificate Services) that's set up with a Key Recovery Agent (KRA). The CA wants to archive your private key so it can be recovered later if you lose it. But your request didn't include the private key in a way the CA can grab it. I saw this last month with a small law firm that set up a new CA for client encryption – their IT guy forgot to check the "Exportable" box in the template. The error message is clear: CERTSRV_E_ARCHIVED_KEY_REQUIRED means the CA is saying "Hey, I need that key, but you didn't pack it up for me."
Fix Steps
1. Check Your Certificate Template
First, look at the template you're using on the CA. Open the Certification Authority snap-in, right-click Certificate Templates > Manage. Find your template, right-click > Properties. Go to the Request Handling tab. Make sure Allow private key to be exported is checked. If not, you need to duplicate the template and enable it, then update your request to use the new template.
2. Generate a Request with Key Archival
Use certreq from an admin command prompt. Create a file called request.inf with this content:
[NewRequest]
Subject = "CN=YourServerName"
KeySpec = 1
KeyLength = 2048
Exportable = TRUE
MachineKeySet = TRUE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
KeyUsage = 0xA0
RequestType = PKCS10
[Attributes]
KeyArchival = TRUE
Then run:
certreq -new request.inf request.reqSubmit that request.req to your CA via the web interface or certreq -submit. The KeyArchival = TRUE attribute tells the CA to archive the private key.
3. Verify Key Recovery Agent Is Set Up
If you still get the error, check that a KRA certificate exists. On the CA server, open Certification Authority, right-click the CA name > Properties > Recovery Agents. There should be at least one KRA listed. If not, issue a KRA certificate first – use a domain admin account, request a template called "Key Recovery Agent" and enroll it.
Alternative Fixes
Switch to a non-archival template. If you don't need key recovery, use a template that doesn't require archival. For example, the standard "Web Server" template often works without it. Just reissue the cert using that template.
Use a different CA. If your CA is misconfigured and you're in a hurry, get the cert from another CA that doesn't enforce archival. Not ideal, but it gets you running.
Force the CA to skip archival. On the CA server, open Registry Editor, go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\[CA Name], create a DWORD DisableArchiveKey and set it to 1. Restart the CA service with net stop certsvc and net start certsvc. This disables the requirement completely – use only if you're sure you don't need key recovery.
Prevention Tip
Before you set up a CA for anything that needs key recovery (like encrypting files or emails), make sure your certificate templates have Allow private key to be exported enabled and you've issued at least one KRA certificate. I keep a checklist for every new CA deployment: template exportable? KRA issued? Archival attribute in request? saves a ton of headache later.
Was this solution helpful?