KRA - Key Recovery Failure

hi all,

i attempting recover private key 1 of our users. have 1 kra specified in our infrastructure. have verified kra listed in kra container in ad in local computer store (kra) on ca.

when issue following command

"certutil -config caname\issuing-ca-01 -v -getkey 12345678901234567890"

i error

"certutil: -getkey command failed: 0x80092004 (-2146885628)
certutil: cannot find object or property."

research of error points lack of kra certificate existing in hklm\kra store on ca. have verified cert in fact exist in kra store on ca , serial number , hash matches certificate certificate published in kra container in ad.

when run following command list certs in kra store on ca, 1 cert found (as expected)

"c:\users\user>certutil -store kra
kra
================ certificate 0 ================
serial number: abcdef1234567890abcd
issuer: cn=caname, dc=contoso, dc=com
notbefore: 1/20/2011 10:24 am
notafter: 1/21/2013 9:37 am
subject: cn=krauser, cn=users, dc=contoso, dc=com
non-root certificate
template: keyrecoveryagent, key recovery agent
cert hash(sha1): aa bb cc dd ee ff 11 22 33 44 55 66 77 88 99 aa bb cc dd ee
no key provider information
encryption test passed
certutil: -store command completed successfully."

however, unable create encrypted blob used "recoverkey" parameter "getkey" command fails above error...furthermore, in gui certificate services, under proerties of ca, under tab "recovery agents", can see kra certificate , status "valid"....nothing on web btw sheds light except technet article points kra cert not being available in kra store on ca...(which is.)

any ideas?

tia!!

the getkey operations requires user have issue , manage certificates permissions @ ca. first thing check. step prior recoverkey operation, not tied in way whether have kra certificate loaded in profile (it appear ok)

i manually check gui certificate in ca database connecting , key archived (turn on archived key column in view options)

brian

Windows Server  >  Security