Windows error 13881 (ERROR_IPSEC_IKE_INVALID_CERT

Status / error code:		Category:

Constant name:
Source:	Operating System:
Description: The certificate key is too short for policy.

Previous	Next
ERROR_IPSEC_IKE_INVALID_MAJOR_VERSION	ERROR_IPSEC_IKE_MM_LIMIT

ERROR_IPSEC_IKE_INVALID_CERT_KEYLEN

Certificate authentication failed a key-strength requirement

The certificate was present, but the public-key length did not satisfy the configured IPsec authentication requirements. That is different from no certificate, an untrusted chain, or a certificate with the wrong key usage. The key itself is below the strength threshold accepted by policy.

Check the certificate actually selected by IKE rather than the certificate an administrator expected it to use. Windows authentication proposals can constrain certificate authority and validation criteria, and multiple machine certificates can exist. Reissuing a certificate from the same template will not help if the template continues to generate a key below the required size.

What to inspect

Identify the certificate thumbprint and public-key size used in the failed exchange.
Compare the selected certificate with the IPsec authentication proposal and issuing template.
Replace or reissue the certificate with compliant key parameters instead of weakening the policy without review.

Get-NetIPsecPhase1AuthSet

References

Looking for a different code? Search another status or error code.