| Previous | Next |
| STATUS_SMARTCARD_NO_KEY_CONTAINER | STATUS_SMARTCARD_NO_KEYSET |
STATUS_SMARTCARD_NO_CERTIFICATE
The smart card did not expose the requested certificate
Smart-card logon starts by enumerating certificates that satisfy Windows requirements. A card can be present and readable while the expected certificate is absent, filtered out by EKU or policy, or not exposed through the selected provider.
For Kerberos PKINIT, inspect both certificate presence and whether Windows considers it usable for smart-card logon. A missing certificate is different from a certificate that exists but later fails chain, revocation or mapping checks.
What to inspect
- Confirm that the certificate appears in the user interface and certificate store view for the card.
- Check Smart Card Logon EKU, UPN/SAN data, expiration, and provider metadata.
- Validate the card with another reader or user profile if enumeration is inconsistent.
References
- Microsoft: Smart card certificate requirements and enumeration
- Microsoft: Enabling smart card logon with third-party CAs
- Microsoft Open Specifications: MS-PKCA
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.