What does HRESULT 0x80090362 (SEC_E_PKU2U_CERT_FAILURE) mean?

SEC_E_PKU2U_CERT_FAILURE

The important part of SEC_E_PKU2U_CERT_FAILURE is its scope: PKU2U certificate use. The peer-to-peer PKU2U package could not select, validate, or use the certificate material needed for public-key user-to-user authentication. Keep the hexadecimal value 0x80090362 with the returning API, because higher-level software may translate it into a message that loses this distinction.

Locate the first failing boundary

In the path, PKU2U is a public-key peer authentication package used without relying on ordinary domain Kerberos in the same way. Certificate selection, private-key access, chain or policy checks, peer trust, and local policy can fail at different points, so record the package trace and certificate identities in a PKU2U certificate use investigation.

Useful observations, not generic logs

1. 1. Certificate thumbprint, issuer, subject, EKU and private-key provider for each peer
   Inspect the local PKU2U certificate stores, private-key access, validity, EKU, and chain status.
2. 2. Package policy, chain result, trust anchors, and private-key accessibility
   Confirm that PKU2U policy is enabled where the workflow expects online identities.
3. 3. The SSPI leg at which the certificate-related failure appears
   Compare both peers because certificate exchange and policy evaluation occur on each side.

For PKU2U certificate use, these observations are deliberately nonsecret: identifiers, lengths, provider names, policy selections, and state transitions usually support comparison without recording private keys, passwords, PINs, or plaintext.

What to include in an escalation package

Authentication failures are multi-leg transactions. Align client SSPI calls, DNS and target-name resolution, policy refresh, domain-controller or KDC events, ticket acquisition, server acceptance, and any proxy or TLS transition., a single application timestamp is not enough to tell whether the decision was local policy, peer identity, context state, or KDC behavior.

• Package and target name, requested and returned context attributes, and each SSPI return in order.
• In the path, relevant Group Policy result, SPN or UPN resolution, contacted DC/KDC, and ticket or certificate identities.
• One permitted control target and one deliberately rejected target evaluated with the same client build in a PKU2U certificate use investigation.

Reproduction without destructive cleanup

Validate each certificate and private key independently under the same account, then run the package exchange with a known-good peer., this separates certificate usability from peer-to-peer package negotiation.

1. Preserve the original input, identity, provider or protocol selection, and first return Value.
2. Use one known-good control that changes only the suspected part of the PKU2U certificate use path.
3. reverse the comparison with known-good input on the failing layer where that can be done safely.
4. Record where behavior first diverges in the PKU2U certificate use path instead of judging only by the final application message.

How this differs from similar failures

Domain Kerberos certificate errors and PKU2U certificate errors belong to different authentication paths; first confirm which SSP was selected. Importing extra roots until the exchange succeeds can mask certificate selection or private-key problems and can change system trust beyond this workflow.

For PKU2U certificate use, also retain the original numeric value; neighboring constants can encode materially different remediation paths even when an application presents all of them as an authentication, certificate, or security failure.

Regression check

Both peers must select the intended certificates, prove possession of their private keys, and complete the package exchange under the intended policy. Keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.

Technical references

These sources define the HRESULT and the relevant PKU2U certificate use interface, protocol, or data format.

• Microsoft Open Specifications: HRESULT values.
• Microsoft: PKU2U authentication policy.
• RFC 4556: Public Key Cryptography for Kerberos.

Looking for a different code? Search another status or error code.