| Previous | Next |
| SEC_E_CROSSREALM_DELEGATION_FAILURE | SEC_E_ISSUING_CA_UNTRUSTED_KDC |
SEC_E_REVOCATION_OFFLINE_KDC
The workstation is checking the domain controller
This status concerns the certificate used by the Key Distribution Center for smart card logon. The affected workstation validates the KDC certificate and its chain before accepting the PKINIT exchange. It is therefore the mirror image of SEC_E_REVOCATION_OFFLINE_C: that code is about the DC validating the user certificate, while this code is about the client validating the DC certificate.
The error is not proof that the KDC certificate was revoked. It means the workstation could not establish revocation status for the KDC certificate or a relevant issuer certificate. A desktop behind a restricted proxy, captive network, VPN split tunnel, or stale CRL cache can fail while other clients continue to sign in successfully.
Diagnose from the affected client
- Identify the KDC certificate actually presented by the domain controller and inspect its issuer chain, CRL Distribution Points, and Authority Information Access entries.
- Test publication-point reachability from the failing workstation, not only from a DC or CA administrator host. Name resolution, proxy policy, TLS inspection, and machine-account network restrictions can differ.
- Verify that every required CRL is current and covers the appropriate issuing CA. A downloaded file is not enough if it is stale, invalid, or signed by an unexpected issuer.
- Compare results from another workstation in the same site and from another network path to separate certificate publication failure from a local network policy issue.
References
- Microsoft: how smart card clients validate the KDC certificate
- RFC 5280: CRL distribution points and validation data
- RFC 6960: OCSP
Looking for a different code? Search another status or error code.