| Previous | Next |
| SEC_E_ISSUING_CA_UNTRUSTED_KDC | SEC_E_KDC_CERT_REVOKED |
SEC_E_KDC_CERT_EXPIRED
Why the domain controller certificate matters
PKINIT authenticates both sides of the initial Kerberos exchange with certificates. This status identifies the certificate used by the domain controller's Key Distribution Center as expired. The user card can be perfectly valid and still fail because the client cannot accept the KDC identity certificate.
Do not confuse it with SEC_E_SMARTCARD_CERT_EXPIRED. That status identifies the user credential on the card; this one is an infrastructure problem that can affect many users who attempt smart card sign-in against the same domain controller.
Recovery without masking the fault
- Identify the certificate selected by the KDC on the affected DC and verify its serial number, subject, EKU, and
notAftervalue. Servers can retain more than one candidate certificate. - Enroll or renew an appropriate KDC certificate from the approved issuing CA, then confirm that the DC is actually presenting the replacement certificate to clients.
- Verify that the replacement chain and revocation publication are reachable from client machines. A new leaf certificate does not repair an untrusted or unavailable issuing chain.
- Check all domain controllers in the logon path. Intermittent failures can result when only some DCs still use an expired certificate.
References
- Microsoft: KDC certificate role in smart card sign-in
- Microsoft: renewing a valid domain controller certificate
- MIT Kerberos: expired PKINIT certificate chains
Looking for a different code? Search another status or error code.