| Previous | Next |
| STATUS_REVOCATION_OFFLINE_C | STATUS_SMARTCARD_CERT_EXPIRED |
STATUS_PKINIT_CLIENT_FAILURE
PKINIT rejected the client certificate trust path
PKINIT lets Kerberos use public-key authentication during the initial AS exchange. This status is returned when the client certificate itself cannot be accepted for that exchange, often because the chain, EKU, mapping, revocation, or issuer trust is wrong.
The certificate can still look syntactically correct in a certificate viewer. The decisive evidence is what the KDC and local logon path accept for smart-card logon and PKINIT policy.
What to inspect
- Review KDC event details, certificate chain and revocation checks.
- Verify Smart Card Logon EKU and client authentication requirements.
- Check strong certificate mapping after Windows domain-controller hardening updates.
References
- Microsoft Open Specifications: MS-PKCA PKINIT in Kerberos
- RFC 4556: PKINIT
- Microsoft: Smart card certificate requirements
- Microsoft Open Specifications: NTSTATUS values
- Microsoft Support: certificate-based authentication changes
Looking for a different code? Search another status or error code.