| Previous | Next |
| SEC_E_PKINIT_CLIENT_FAILURE | SEC_E_NO_S4U_PROT_SUPPORT |
SEC_E_SMARTCARD_CERT_EXPIRED
Expired client credential, not an expired KDC identity
This status identifies the smart card certificate used by the user as being outside its certificate validity interval. It is different from SEC_E_KDC_CERT_EXPIRED, which concerns the certificate installed on the domain controller. Replacing a valid KDC certificate will not renew an expired user credential, and reissuing the user certificate will not repair an expired KDC certificate.
Certificate validity is evaluated against the current time and the notBefore and notAfter fields. A card can contain more than one certificate, so an unexpected result can also come from the credential provider choosing an older certificate than the one an administrator inspected.
Targeted checks
- Read the validity period from the certificate selected at the sign-in screen, then compare it with the workstation and domain controller clocks.
- Confirm that the intended replacement certificate is present on the card with its matching private key and is visible to the smart card credential provider.
- Check the complete issuing chain as well. A renewed leaf certificate can still fail PKINIT if an intermediate or trust anchor required for validation is expired or unavailable.
- After reissuance, verify the UPN and smart card logon profile before assuming that enrollment alone has restored account mapping.
References
- Microsoft: smart card certificate and configuration problems
- RFC 4556: PKINIT certificate use
- MIT Kerberos: PKINIT certificate-chain troubleshooting
Looking for a different code? Search another status or error code.