| Previous | Next |
| STATUS_SMARTCARD_CERT_REVOKED | STATUS_REVOCATION_OFFLINE_C |
STATUS_ISSUING_CA_UNTRUSTED
The issuing CA for the authentication certificate is not trusted
This status appears during certificate-based authentication when the chain for the client certificate cannot be trusted. In smart-card logon, both certificate requirements and domain-controller validation rules matter.
Do not reduce the problem to card hardware. The card may contain a valid private key, but the relying Windows component or KDC rejects the issuer chain, trust anchor, EKU, policy, or revocation state.
What to inspect
- Verify root and intermediate CA trust on clients and domain controllers.
- Check certificate chain, EKU, issuance policy and revocation reachability.
- Confirm whether the failing certificate was issued by a third-party CA or new enterprise CA.
References
- Microsoft: Smart card certificate requirements and enumeration
- Microsoft: Enabling smart card logon with third-party CAs
- Microsoft Open Specifications: MS-PKCA
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.