| Previous | Next |
| SEC_E_KDC_CERT_EXPIRED | SEC_E_INVALID_PARAMETER |
SEC_E_KDC_CERT_REVOKED
A positive revocation result for the KDC
This status is more specific than a revocation lookup failure. Windows obtained a usable status result and found that the certificate used by the Key Distribution Center for smart card logon is revoked. The client should not continue to trust that KDC certificate for PKINIT merely because the certificate has not reached its normal expiration date.
Unlike SEC_E_REVOCATION_OFFLINE_KDC, the fault is not primarily a network path to a CRL or OCSP service. The incident response must start with the reason the certificate was revoked, such as key compromise, supersession, incorrect issuance, or a change in domain controller identity.
Containment and replacement
- Confirm the serial number and issuer of the certificate reported as revoked. This prevents replacing the wrong certificate when a DC has multiple historical or automatically enrolled certificates.
- Review the revocation reason and the CA audit trail before issuing a replacement. A possible private-key compromise requires a different response from routine supersession.
- Enroll a replacement KDC certificate that meets the approved profile, then verify that clients receive that replacement and can build a trusted, current chain.
- Keep revocation publication healthy while remediating. Suppressing validation or using an older CRL only hides the security decision that correctly rejected the certificate.
References
- Microsoft: smart card sign-in certificate validation
- RFC 5280: certificate revocation lists
- RFC 6960: OCSP status responses
Looking for a different code? Search another status or error code.