| Previous | Next |
| ERROR_IPSEC_IKE_ERROR | ERROR_IPSEC_IKE_INVALID_KEY_USAGE |
ERROR_IPSEC_IKE_CRL_FAILED
ERROR_IPSEC_IKE_CRL_FAILED means Windows could not complete the revocation check required for a certificate used by IKE. It does not automatically mean that the certificate is revoked; the revocation location may be unavailable, blocked, expired, or unable to validate.
Separate revocation-infrastructure failure from an actually revoked certificate. Test the CRL or OCSP path from the machine context that performs IKE authentication and preserve the chain status before disabling revocation checks.
What to check
- Inspect the certificate CRL Distribution Point and confirm the machine can reach it in the IKE service context.
- Check the local clock, certificate validity and chain trust before changing revocation policy.
- Compare the failure with
ERROR_IPSEC_IKE_PEER_CRL_FAILED, which applies to the remote certificate.
Microsoft: IKE/AuthIP authentication methods
Looking for a different code? Search another status or error code.