| Previous | Next |
| ERROR_IPSEC_IKE_PEER_MM_ASSUMED_INVALID | ERROR_IPSEC_IKE_UNEXPECTED_MESSAGE_ID |
ERROR_IPSEC_IKE_CERT_CHAIN_POLICY_MISMATCH
The peer certificate does not chain to an allowed policy root
Certificate authentication can succeed cryptographically yet still fail IPsec policy selection. This status means the certificate chain does not terminate at a trusted root accepted by the configured IPsec authentication policy. It is distinct from a malformed signature, missing private key, or certificate key-length failure.
The trust store alone is not enough to diagnose it. Windows IPsec authentication proposals can identify certificate authorities and validation criteria. A root that is generally trusted by the computer may still be outside the authority constraints of the active IPsec rule.
What to inspect
- Identify the exact peer certificate and build its chain to the root used during negotiation.
- Compare that root and certificate criteria with the active Phase 1 authentication set.
- Check policy on both peers; certificate-authority restrictions are directional configuration and can differ.
Get-NetIPsecPhase1AuthSetReferences
- Microsoft: New-NetIPsecAuthProposal
- Microsoft: New-NetIPsecMainModeRule
- Microsoft: Get-NetIPsecMainModeSA
Looking for a different code? Search another status or error code.