| Previous | Next |
| SEC_E_MUTUAL_AUTH_FAILED | SEC_E_APPLICATION_PROTOCOL_MISMATCH |
SEC_E_ONLY_HTTPS_ALLOWED
SEC_E_ONLY_HTTPS_ALLOWED should be read at the transport requirement for credential protection boundary. The selected authentication or enrollment workflow refuses to continue over a non-HTTPS scheme because the operation requires an authenticated encrypted transport. For transport requirement for credential protection, the useful diagnostic question is which concrete object and operation caused Windows to select this exact HRESULT—not whether a key, certificate, account, file, or device merely “works.”
Read the failure at the correct layer
In the path, this status is a scheme-level policy decision: the workflow has determined that HTTP or another non-HTTPS scheme is unacceptable. Record the URL after redirects, proxy or reverse-proxy termination, forwarded scheme information, and the channel seen by the component returning the HRESULT in a transport requirement for credential protection investigation.
Build an incident record
| Record | Why it matters for this code |
|---|---|
| original URL, redirect chain, final scheme and authority | In the path, pINs the result to a specific handshake or KDC decision. |
| where TLS terminates and which component evaluates the scheme | Separates identity proof from delegation or transport policy. |
| proxy forwarding headers or configuration used to reconstruct the external URL | Keeps target names, package selection, and context state comparable. |
Code-specific checks:
- Log the original URI after redirects and proxy rewriting.
- Validate the TLS certificate and ensure the application is not terminating HTTPS before passing an HTTP origin URI to the security package.
- Do not bypass the scheme check; configure the endpoint and callback URLs consistently as HTTPS.
Build a timeline before changing state
Authentication failures are multi-leg transactions. Align client SSPI calls, DNS and target-name resolution, policy refresh, domain-controller or KDC events, ticket acquisition, server acceptance, and any proxy or TLS transition., a single application timestamp is not enough to tell whether the decision was local policy, peer identity, context state, or KDC behavior.
- Package and target name, requested and returned context attributes, and each SSPI return in order.
- In the path, relevant Group Policy result, SPN or UPN resolution, contacted DC/KDC, and ticket or certificate identities.
- One permitted control target and one deliberately rejected target evaluated with the same client build in a transport requirement for credential protection investigation.
Use two comparison axes
Call the same endpoint directly over HTTPS and through the production proxy path., if only the proxied path fails, compare scheme reconstruction and redirect generation rather than authentication credentials.
- Preserve the original input, identity, provider or protocol selection, and first return Value.
- Use one known-good control that changes only the suspected part of the transport requirement for credential protection path.
- reverse the comparison with known-good input on the failing layer where that can be done safely.
- Record where behavior first diverges in the transport requirement for credential protection path instead of judging only by the final application message.
Do not collapse it into a neighboring code
This is a transport-policy result. It does not say that the server certificate chain is valid; that must be checked separately. Changing a client flag to permit cleartext traffic defeats the reason for it and may expose credentials or enrollment data.
For transport requirement for credential protection, also retain the original numeric value; neighboring constants can encode materially different remediation paths even when an application presents all of them as an authentication, certificate, or security failure.
Verification after the change
The returning component must observe an authenticated HTTPS channel for the intended public URL, including the production proxy or load-balancer path. Keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.
Technical references
These sources define the HRESULT and the relevant transport requirement for credential protection interface, protocol, or data format.
- Microsoft Open Specifications: HRESULT values.
- Microsoft: InitializeSecurityContext.
- Microsoft: Credential Security Support Provider.
Looking for a different code? Search another status or error code.