What does HRESULT 0x00090360 (SEC_I_NO_RENEGOTIATION) mean?

SEC_I_NO_RENEGOTIATION

Peer rejected security-context renegotiation

SEC_I_NO_RENEGOTIATION is HRESULT 590688 (0x00090360) from winerror.h. The documented description is “The recipient rejected the renegotiation request.” The severity bit indicates a nonfailure result, but the value carries a specific condition that must not be collapsed into plain S_OK.

In the SSPI authentication or message-protection state machine, this result means that the recipient rejected the renegotiation request. Acceptance depends on the returned state and outputs, not only on the cleared severity bit.

What must be true before accepting it

Verify that the existing context remains safe for permitted traffic or the connection is closed before different security parameters are required. This check separates a legitimate SEC_I_NO_RENEGOTIATION outcome from code that ignores an incomplete or altered operation.

Before retrying this result, classify its effects as completed, partial, pending, cancelled, adapted, or terminal.

Where the status is encountered

• This result can be returned during InitializeSecurityContext or AcceptSecurityContext loops; log the exact method and object state instead of interpreting the constant outside that contract.
• It can be returned during Schannel or another security package; log the exact method and object state instead of interpreting the constant outside that contract.
• It can be returned during message signing, fragmentation, or asynchronous SSPI processing; log the exact method and object state instead of interpreting the constant outside that contract.

Evidence to preserve

• Preserve security package and protocol version.
• Preserve current cipher and context attributes.
• Preserve renegotiation trigger.
• Preserve peer response bytes.
• Preserve decision to continue or reconnect.

Correct handling and recovery

Do not loop on renegotiation. Continue only if the current protocol and policy allow it; otherwise establish a fresh connection and security context.

Practical scenario

A TLS peer rejects renegotiation requested for a client certificate. The server closes the session and requires a new handshake rather than retrying renegotiation indefinitely.

Difference from nearby results

The distinction around it determines whether the caller stops, waits, consumes output, or changes state.

References

• Microsoft: SSPI status codes — official Microsoft material relevant to this HRESULT.
• Microsoft: SSPI context semantics
• Microsoft: InitializeSecurityContext
• Microsoft: DecryptMessage
• Microsoft: HRESULT values