If the Microsoft CA settings configure Request Handling as follows.
Parameter | Value |
---|---|
Purpose | Signature |
Delete revoked or expired certificates | |
Allow private key to be exported | |
For automatic renewal of smart card certificates, use the existing key if a new key cannot be created | |
Do the following when the public subject is enrolled and when the private key associated with this certificate is used | Prompt the user during enrollment |
As we see, the Archive subject's encryption private key option is disabled when selecting the Signature template.