| Previous | Next |
| STATUS_PKINIT_CLIENT_FAILURE | STATUS_DRIVER_FAILED_PRIOR_UNLOAD |
STATUS_SMARTCARD_CERT_EXPIRED
Expiry is a certificate lifecycle event
STATUS_SMARTCARD_CERT_EXPIRED indicates that the certificate selected for authentication is no longer within its validity period. The card can still be inserted, its PIN can still be correct, and the reader can still work; the authentication flow fails because the certificate is no longer eligible. That is why re-entering the PIN, reinstalling a reader driver, or merely restarting the client does not resolve this condition.
Certificate-based Kerberos initial authentication uses the public-key credential and the domain’s trust configuration. The practical remedy is normally certificate renewal or replacement through the organisation’s PKI process, followed by verification that the new certificate is available on the intended card and meets the authentication requirements.
A controlled renewal check
- Record the certificate subject, issuer, serial number, validity window, EKU and the card/provider from which it was selected.
- Confirm that renewal or reissuance has completed and that the old certificate is not still being selected by the sign-in path.
- Validate the complete chain and domain-controller acceptance after the replacement is installed.
- Do not remove expired certificates or reset the card until the issuer’s recovery and retention requirements are understood.
References
- Microsoft Open Specifications: NTSTATUS reference
- RFC 4556: PKINIT
- Microsoft: Event 4771, Kerberos pre-authentication failed
- Microsoft: smart-card certificate requirements
Looking for a different code? Search another status or error code.