Fix CERTSRV_E_KEY_LENGTH (0x80094811) — public key too small

When does this error actually show up?

You'll see 0x80094811 — or the friendlier text CERTSRV_E_KEY_LENGTH — when you try to enroll a certificate through an Active Directory Certificate Services (AD CS) enterprise CA, and the certificate template you're using has a minimum key size requirement that your request doesn't meet. This often bites people automating certificate requests with PowerShell, or when someone generates a CSR with the wrong key length, then submits it to the CA.

Typical trigger: you're using a template like "Web Server" or "Smartcard Logon" that demands at least 2048-bit RSA keys, but your client machine generates a 1024-bit key. The CA rejects it at the enrollment step with this exact error. Another common scenario: a legacy application that still requests 1024-bit keys against a hardened CA that's been updated to require 2048-bit minimum.

What's actually happening here?

The certificate template stored on your CA defines a set of issuance requirements. One of those is the minimum key size — usually under the Cryptography tab or the msPKI-Minimal-Key-Size attribute. When the CA receives a certificate request, it checks the Public Key field inside the PKCS#10 request. If that key's bit length is less than the template's minimum, the CA returns 0x80094811. Full stop.

This is a security hardening feature. The idea is to stop weak keys from being issued in environments that have already moved past them. The Windows default templates from Server 2008 R2 onward set 2048 as the floor. Server 2012 and later templates often use 2048 or higher. If you're still using 1024-bit keys, they're mathematically breakable by state-level actors, and the CA is doing its job by blocking them.

Fix: three paths, pick one

You have two real fixes and one diagnostic step. Don't try to change the CA's policy unless you know what you're doing — that's a third path but rarely needed.

Path 1: Increase the key size in your request

1. Figure out what the template requires. Open the Certificates MMC on the CA (certsrv.msc), right-click the template, select Properties, go to the Cryptography tab. Under Minimum key size, you'll see the number. It's usually 2048.
2. Regenerate your CSR or certificate request with a key size at or above that number. If you're using PowerShell's Get-Certificate or New-SelfSignedCertificate, pass the -KeyLength parameter:

# For a certificate request via certreq.exe:
certreq -new -q -key 2048 request.inf request.req

# For PowerShell:
Get-Certificate -Template WebServer -DnsName server01.contoso.com -KeyLength 2048

3. Submit the new request. The CA should accept it now.

Path 2: Modify the template to allow smaller keys (not recommended)

I'll be blunt: don't do this unless a legacy app forces you to. Reducing the key size weakens every certificate issued from that template. But if you must:

1. On the CA, open Certificate Templates snap-in.
2. Duplicate the template by right-clicking it and choosing Duplicate Template. Give it a new name like "Web Server Legacy".
3. Go to the Cryptography tab. Change Minimum key size to 1024 (or whatever fits your legacy client).
4. On the Superseded Templates tab, add the original template so the new one takes precedence for legacy requests.
5. Right-click Certificate Templates > New > Certificate Template to Issue, and select your new template.
6. Re-issue the certificate with the updated template. Clients requesting with 1024-bit keys will now work.

Path 3: Check if the CA itself has a global minimum policy

Sometimes the CA has a blanket policy overruling per-template settings. Check this registry key on the CA server:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\[CA Name]\

Look for MinKeySize or MaxKeySize values. If they're set, they override the template's minimum. You can raise them but can't lower them below what the template specifies — the CA will still enforce the higher of the two. Delete the MinKeySize value if it exists and you want per-template behavior. Then restart the CA service:

net stop certsvc && net start certsvc

Still failing? Check these three things

• Key specification: Some templates require an Exchange key (for encryption) instead of a Signature key. The CSP or KSP you're using might not support the requested key length. Switch from the Microsoft Software Key Storage Provider to the Microsoft Enhanced RSA and AES Cryptographic Provider if you hit this.
• Template version: Older templates (Windows 2003 era) sometimes default to 1024 and you might be unknowingly using a newer version of the same template. Check the template version number in the Properties dialog — version 3 templates on Server 2012+ enforce 2048 minimums.
• Client-side CSP limitations: A Windows 7 client with only the old CSP installed can't generate 4096-bit keys. Upgrade the client or install the Microsoft Enhanced RSA and AES Cryptographic Provider (which ships with KB2868725 on older systems).

One last thought: if you're still stuck after checking all of that, grab the failed request ID from the CA's Issued Certificates folder, then look at the Request Status Code in the event log (Applications and Services Logs > Microsoft > Windows > CertificateServices > Operational). The detailed error message will tell you exactly which attribute failed.