| Previous | Next |
| SEC_E_REVOCATION_OFFLINE_KDC | SEC_E_KDC_CERT_EXPIRED |
SEC_E_ISSUING_CA_UNTRUSTED_KDC
Trust failure for the KDC certificate chain
For PKINIT, the client must accept the certificate that proves the identity of the Key Distribution Center. This status means that the issuing CA for that KDC certificate did not lead to an acceptable trust decision on the affected machine. It is not the same as an unreachable CRL or an expired certificate: the chain itself is not trusted for this use.
A seemingly correct certificate can still fail if the DC selected a different certificate than expected, an intermediate certificate is missing, the root is absent from the relevant trust store, the issuing CA is not published in the locations required by the AD smart card deployment, or the certificate profile does not satisfy the KDC role.
Establish which chain Windows used
- Capture the actual domain controller certificate used for smart card authentication. Check its subject alternative name, EKU, issuer, serial number, and validity period instead of relying only on the certificate template name.
- Build the chain on the failing client and compare it with a working client. Record the first untrusted issuer or missing intermediate rather than importing certificates blindly.
- Verify the Active Directory NTAuth publication and root or intermediate trust required by the deployment. These are related controls, but they are not interchangeable with simply trusting an arbitrary public CA.
- Check that the KDC certificate is renewed and selected consistently across domain controllers. Mixed issuance hierarchies can create site-specific failures.
References
- Microsoft: KDC certificate requirements for smart card sign-in
- Microsoft: trust and NTAuth requirements for smart card logon
- MIT Kerberos: KDC certificate and trust anchors
Looking for a different code? Search another status or error code.