VBR 13.1.1.18 on Windows: Data Mover, VSS Integration and vPower NFS services fail – "Failed to export private key to DER format" (0x8009000b / 0x80090029)

Environment

• VBR 13.1.1.18 (incl. patch 20260812), all-in-one backup server on Windows 11 Enterprise (build 26200)
• Upgraded 2026-10-13 with the full 13.1.1.18 ISO from 13.1 (I believe 13.1.0.411)
• Config DB on local SQL Express (VEEAMSQL2016). Veeam ONE 13.1 installed on the same machine (test only)
• Repositories in folders on a local iSCSI volume (Synology LUN) + Azure Blob immutable

Symptom

Since the upgrade, Rescan of the backup server fails:

  "Disks and volumes discovery failed Error: No connection could be made because the target machine actively refused it"

  "Microsoft Windows server discovery failed" (same error)

Nothing listens on 6162 although VeeamTransportSvc shows "Running". Installer Service on 6160 works.

What the logs show (Svc.VeeamTransport.log, identical in Svc.VeeamFilesysVssIntegration.log and Svc.VeeamNFS.log)

  Searching server certificate thumbprint in registry

    New thumbprint found in registry: <thumbprint>

    Certificates found: 1

    Modifying export policy to allow plaintext export

  WARN|Failed to modify export policy. Status: 0x8009000b. Export may fail.

  WARN|Failed to load server certificates

  >> The requested operation is not supported.

  >> Failed to get private key size. Error code: 0x80090029

  >> Failed to export private key to DER format.

  ERR |Failed to start vcp server.

  >> The VCP server certificate & key are not available.

Svc.VeeamInstaller.log shows the same failure, but the Installer Service then enters

"FIPS 140-3 mode", generates a new PEM server certificate, installs it and starts 6160.

The other services only read from the store and fail. Result: a new certificate is created

in "Veeam Backup & Replication Certificates" every time the Installer Service restarts

(now 9 certs, all with the same issue).

Certificate details (all certs in that store)

• RSA, provider "Microsoft Enhanced Cryptographic Provider v1.0", ExportPolicy = AllowExport (not AllowPlaintextExport)
• PFX export works; plaintext export (RSA ExportParameters / PKCS8 blob) fails with "operation not supported"

Already tried / ruled out

• Service account: same result as LocalSystem and as a local admin account
• Windows FIPS policy is disabled (FipsAlgorithmPolicy\Enabled = 0)
• No SCHANNEL/crypto hardening applied; MachineKeys ACL contains default entries (plus two local accounts with full control)
• Full uninstall + reinstall of 13.1.1.18 (connected to the existing DB): identical errors; setup fails at "starting services" for VeeamFilesysVssSvc and VeeamNFSSvc
• Windows updates on this machine were installed after the problem first appeared

Questions

1. Is this a known issue in 13.1.1? Is there a workaround to make VBR regenerate the certificate with a plaintext-exportable key, or to point the services to a working cert?
2. Would 13.1.0.411 be affected as well? (The first new cert was created during the upgrade, right after a 13.1.0.411 component was installed.)