| Previous | Next |
| STATUS_MUST_BE_KDC | STATUS_TOO_MANY_PRINCIPALS |
STATUS_STRONG_CRYPTO_NOT_SUPPORTED
Security negotiation required stronger crypto than this host supports
These status values come from the Windows Filtering Platform path. For STATUS_STRONG_CRYPTO_NOT_SUPPORTED, wFP classifies traffic through layers, filters, provider contexts, sublayers, and callouts; IPsec policy is also configured through WFP at IKE/AuthIP-related layers.
This status belongs to security negotiation. The remote side requires a stronger cryptographic mode or algorithm set than the local machine can use in that context.
For STATUS_STRONG_CRYPTO_NOT_SUPPORTED, when this appears during IPsec or AuthIP negotiation, compare the Main Mode, Quick Mode, Extended Mode, transform, tunnel endpoint, DNS name, and authentication-method policy actually installed in WFP.
What to inspect
- Compare local and peer crypto policy.
- Check OS version, FIPS policy, certificate algorithms, and IPsec proposal lists.
- Do not treat this as a password failure.
References for STATUS_STRONG_CRYPTO_NOT_SUPPORTED
Looking for a different code? Search another status or error code.