Fix XENROLL_E_KEY_NOT_EXPORTABLE 0X80095000 Error

What Causes This Error

XENROLL_E_KEY_NOT_EXPORTABLE (0x80095000) happens when you try to export a certificate that has its private key marked as non-exportable. This is common when you import a PFX without checking "Mark this key as exportable" or when a CA issues a cert with that flag hard set. I see this most often when people try to migrate RDS or IIS certificates between servers.

Quick Fix — 30 Seconds: Check If Export Is Even Allowed

Before you waste time, check if the key is marked exportable at all. Open certlm.msc (Local Machine store) or certmgr.msc (Current User store), find the cert, double-click it. Go to the Details tab and look for Key Exportable. If it says "No", you're stuck — the OS won't let you export it. If it says "Yes", try exporting again using the wizard. Make sure you check "Export the private key" and enter a password.

Still failing? Move to the moderate fix.

Moderate Fix — 5 Minutes: Use MMC Snap-In to Force Export

The built-in export wizard often fails silently. Instead, use the Certificates MMC snap-in with the right context. Here's how:

Press Win+R, type mmc, hit Enter.
Go File > Add/Remove Snap-ins.
Pick Certificates, choose Computer account, click Next, select Local computer, finish.
Expand the cert store, find the certificate, right-click it, select All Tasks > Export.
In the wizard, choose Yes, export the private key. If that option is grayed out, you can't — skip to the advanced fix.
Check Export all extended properties and set a strong password.
Export as PFX.

This works about 70% of the time. If the wizard still blocks you, move on.

Advanced Fix — 15+ Minutes: Re-Import with Exportable Flag

This is the nuclear option. You need to re-import the original PFX (or get a fresh one from your CA) and force the exportable flag. The culprit here is almost always that someone didn't check the exportable box when they created the original PFX. Here's how to fix it:

Open PowerShell as Administrator.
Find the certificate thumbprint:
```
Get-ChildItem -Path Cert:\LocalMachine\My
```
Find the thumbprint for your cert.
Now export it with the private key using the CAPI2 method — this bypasses the GUI restrictions:
```
$cert = Get-ChildItem -Path Cert:\LocalMachine\My\""
$cert.PrivateKey | Export-ModifiedPrivateKey
```
This command requires the Export-ModifiedPrivateKey module from the PowerShell Gallery. Install it first:

Install-Module -Name Export-ModifiedPrivateKey -Force

Run these lines to extract the key and re-import it as exportable:

$cert = Get-ChildItem -Path Cert:\LocalMachine\My\""
$password = Read-Host -AsSecureString "Enter password for new PFX"
Export-PFXCertificate -Cert $cert -FilePath "C:\Temp\exported.pfx" -Password $password -Exportable

Now delete the old cert from the store (yes, really).
Double-click the new PFX, import it, and THIS TIME check Mark this key as exportable.

This is the real fix. Don't bother with the certutil -repairstore command — it rarely helps here because the flag is baked into the key blob.

When All Else Fails: Reissue the Certificate

If you don't have the original PFX or the CA won't let you reissue, you're stuck. The key was created with a hard non-exportable flag, and no tool can change that. You need to request a new certificate from your CA, but this time ask them to mark it as exportable. If you're using an internal CA (like AD CS), generate a new cert request using certreq -new request.inf certnew.cer. Make sure your request.inf includes this line:

Exportable = true

Then import the new cert with the exportable flag checked.

Prevention Tips

Always check Mark this key as exportable when importing PFX files. There's no downside unless you're paranoid about security.
When requesting certs from an internal CA, specify Exportable = true in your request INF file.
Back up certificates immediately after import — export them to a safe place while they're still working.

That's it. The 0x80095000 error is annoying but fixable. Stick with the moderate fix first, go to the advanced one if needed. Skip the quick fix if you already know the key isn't exportable — it'll waste your time.