| Previous | Next |
| ERROR_IPSEC_IKE_AUTHORIZATION_FAILURE | ERROR_IPSEC_IKE_AUTHORIZATION_FAILURE_WITH_OPTIONAL_RETRY |
ERROR_IPSEC_IKE_STRONG_CRED_AUTHORIZATION_FAILURE
ERROR_IPSEC_IKE_STRONG_CRED_AUTHORIZATION_FAILURE is more specific than a general authorization failure. Windows reports that the Security Association was denied because no sufficiently strong PKINIT-based credential was available for the policy. PKINIT is the Kerberos extension that uses public-key cryptography during initial authentication.
The status should not be treated as proof that an IPsec encryption transform is weak. It refers to the credential and the policy that authorizes its use: the selected certificate or smart-card identity, the private key, the trust and mapping path, and any strength requirements applied by the authentication policy.
What to inspect
- Which credential Windows actually selected for the user or computer, not merely which certificates are visible in a store.
- The certificate validity period, chain and revocation status, accessible private key, and the intended identity and usage for the deployed policy.
- Whether the relevant domain controller can perform the expected PKINIT validation and whether the account is eligible for the required authentication method.
- The active IPsec phase-one authentication policy, including any rule that requires certificate or smart-card based identity.
Compare it with ERROR_IPSEC_IKE_AUTHORIZATION_FAILURE: that code is a general policy rejection, while this one preserves the additional fact that credential strength was insufficient. Replacing cipher suites or retrying without changing the credential state does not address that distinction.
References
- RFC 4556: PKINIT for Kerberos
- Microsoft: Windows PKINIT protocol specification
- Microsoft: IPsec phase-one authentication sets
Looking for a different code? Search another status or error code.