| Previous | Next |
| ERROR_IPSEC_IKE_SHUTTING_DOWN | ERROR_IPSEC_IKE_PROCESS_ERR_NATOA |
ERROR_IPSEC_IKE_CGA_AUTH_FAILED
The cryptographic binding for the IPv6 address could not be verified
A Cryptographically Generated Address binds an IPv6 interface identifier to public-key material and auxiliary parameters. Microsoft IKE extensions list CGA authentication as a supported extension on applicable Windows releases. This status means Windows could not verify the required binding between the CGA address and certificate context.
This is not ordinary CA-chain validation. RFC 3972 defines generation and verification of CGAs, while Secure Neighbor Discovery uses CGA and signature mechanisms for IPv6 neighbor-discovery security. Examine the IPv6 address, CGA parameters, public key, and certificate association used by the exchange.
What to inspect
- Confirm the address being authenticated is the CGA expected for the presented key material.
- Validate CGA parameters and the hash-derived interface identifier.
- Separate CGA binding failure from certificate chain or certificate key-length errors; they are different checks.
References
- IETF RFC 3972: Cryptographically Generated Addresses
- IETF RFC 3971: Secure Neighbor Discovery
- Microsoft Open Specifications: MS-IKEE product behavior
Looking for a different code? Search another status or error code.