| Previous | Next |
| STATUS_INVALID_IMAGE_WIN_64 | STATUS_NETWORK_SESSION_EXPIRED |
STATUS_BAD_BINDINGS
Channel binding is intended to make forwarded authentication fail when the TLS channel is different
STATUS_BAD_BINDINGS corresponds to incorrect SSPI channel bindings. Extended Protection for Authentication can bind an authentication protocol to a TLS session so that credentials forwarded over a different TLS channel do not validate. Windows represents channel-binding input with SEC_CHANNEL_BINDINGS and passes it to the security context negotiation.
The failure therefore needs both authentication and transport context. Record where TLS terminates, whether a reverse proxy or load balancer opens a second TLS connection, and which component calculates the channel-binding token. A client that binds to its TLS connection cannot match a server that validates against a different proxy-to-backend connection unless the deployment explicitly supports that architecture.
Do not disable Extended Protection before proving a deployment mismatch. Compare a direct connection with the proxied path and inspect EPA policy on the accepting service. Treat channel-binding values as authentication material: log presence, type, length and hash correlation where safe, not the raw tokens. Upgrades can also expose old clients that omit bindings when the server begins enforcing them.
What to inspect
- TLS termination points and whether client-to-proxy and proxy-to-server are separate protected channels.
- EPA/channel-binding policy on the accepting service and the SSPI package selected by negotiation.
- Whether the client supplied channel bindings, their type and length, and whether direct versus proxied connections differ.
References
- Microsoft: Extended Protection and channel binding
- Microsoft: SEC_CHANNEL_BINDINGS
- Microsoft: AcceptSecurityContext sequencing
- Microsoft: SSPI status codes
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.