> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-software/troubleshoot/command-centre-errors/keyset-does-not-exist-mobile.md).

# Keyset Does Not Exist (Mobile)

Mobile enrolment fails. Command Centre's mobile enrolment component must access the CA certificate's **private key** using the Network Service account or a dedicated service account. When the CA certificate is imported, the private-key permissions are often **not configured correctly by default**. As a result, **the service cannot access the certificate**, causing mobile enrolment to fail.

**Log excerpt (Command\_Centre.log):**

```
2020-09-11 15:42:34:920, CCNTSad[0eb8:3bdc], INFO, EnrolmentController.Enrol Mobile Enrol Attempt: remoteIp="[REDACTED]"
2020-09-11 15:42:34:922, CCNTSad[0eb8:3bdc], TRACE, C:\build\Elmo\Common\CryptoApi.h(214): Throwing Error 80090005 Bad Data.
2020-09-11 15:42:34:923, CCNTSad[0eb8:3bdc], TRACE, completeEnrolment: Enrolment key incorrect for device 9038715 (decryption failed with error 80090005)
2020-09-11 15:42:34:938, CCNTSad[0eb8:3bdc], TRACE, C:\build\Elmo\Common\CCFTCertificate.cpp(633): Throwing Error 80090016 Keyset does not exist
```

**Mobile log excerpt:**

```
ERR  json error {
    code = "-2146893802";
    message = "Keyset does not exist";
```

## Resolution

Grant Network Service read access to the CA private key.

1. On the server, launch **certlm.msc** to open the **Local Machine Certificate Manager**.
2. Navigate to **Gallagher Applications → Certificates** and locate the **Gallagher Command Centre CA** certificate.
3. Drag and drop the certificate into the **Personal** store.
4. Open the **Personal** store, locate the CA certificate, right-click it, and select **All Tasks → Manage Private Keys...**
5. In the permissions dialog, click **Add**.
6. Select the **Advanced** tab, then next to the owner field click **Change**.
7. Set the owner to the **local Administrators group** and confirm with **OK**.
8. In **From this location**, change the value to the **local computer name**, not the domain.
9. In **Enter the object names to select**, type **Network Service**, then click **Check Names**. The name should become underlined and appear in uppercase, indicating a valid object.
10. Click **OK**. **NETWORK SERVICE** should now appear in the user list.
11. Select **NETWORK SERVICE** and ensure the **Allow** permission is enabled for **Read** only (Full Control is not required).
12. Click **OK** to close the private-key permissions dialog.
13. Move the CA certificate from the **Personal** store back into **Gallagher Applications → Certificates**.
14. Mobile enrolment should now function correctly.

Service restarts should not be required; however, if the issue persists, restart the **Command Centre services** and test again.

**Log location:** `C:\ProgramData\Gallagher\Command Centre` or the Mobile client logs.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.security.gallagher.com/knowledge-hub/products/cc-software/troubleshoot/command-centre-errors/keyset-does-not-exist-mobile.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.