| Previous | Next |
| SEC_E_BUFFER_TOO_SMALL | SEC_E_TIME_SKEW |
SEC_E_WRONG_PRINCIPAL
SEC_E_WRONG_PRINCIPAL means that the identity presented by the peer does not match the target identity requested by the caller. For Schannel, the target name supplied to InitializeSecurityContext is used to verify the server certificate.
Typical causes
- The client connected by an alias, IP address or internal host name that is not represented by the server identity.
- The configured Kerberos SPN names a different service instance.
- A proxy, load balancer or test endpoint presents a certificate for another name.
What to check
Compare the requested target name with the DNS name or SPN the client intended to reach and with the identity offered by the peer. Correct the naming or certificate configuration rather than disabling name validation.
Microsoft: InitializeSecurityContext (General) · InitializeSecurityContext (Schannel)
Looking for a different code? Search another status or error code.