| Previous | Next |
| STATUS_CROSSREALM_DELEGATION_FAILURE | STATUS_ISSUING_CA_UNTRUSTED_KDC |
STATUS_REVOCATION_OFFLINE_KDC
The KDC certificate revocation status is unavailable
Smart-card logon and PKINIT require certificate validation, and revocation status is part of that validation. This status means the domain controller certificate revocation state could not be determined, commonly because CRL or OCSP information is unreachable or invalid.
The failure is not necessarily on the client certificate. The message specifically points at the domain controller certificate used for authentication, so domain-controller PKI health is central to the diagnosis.
What to inspect
- Check CRL distribution points and OCSP availability from domain controllers.
- Validate the domain-controller certificate chain and revocation information.
- Inspect KDC and certificate-services events before reissuing user smart cards.
References
- Microsoft Open Specifications: MS-PKCA PKINIT in Kerberos
- RFC 4556: PKINIT
- Microsoft: Smart card certificate requirements
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: Enabling smart card logon with third-party CAs
Looking for a different code? Search another status or error code.