| Previous | Next |
| STATUS_NO_SECURITY_CONTEXT | STATUS_BEYOND_VDL |
STATUS_PKU2U_CERT_FAILURE
PKU2U is a certificate-based peer authentication path without a Kerberos KDC
STATUS_PKU2U_CERT_FAILURE is specific to Public Key Cryptography Based User-to-User authentication. Microsoft describes PKU2U as an SSP based on Kerberos V5 messages and the Kerberos GSS-API mechanism but operating without a Kerberos KDC. The SSP obtains a local certificate, exchanges certificate-related policy and metadata with the peer, validates the peer material, and associates the certificate with a security token.
Diagnose the certificate stage rather than treating the status as a generic Kerberos service-ticket failure. Confirm that PKU2U is enabled where the scenario requires it, identify the peer identities and certificates selected, and validate certificate chains, validity periods, key usage and revocation reachability. Because NegoExts providers do not have the same fallback behavior as ordinary Kerberos/NTLM negotiation, a PKU2U failure can terminate the authentication path.
Do not enable PKU2U everywhere merely to bypass the error. The policy controls whether online identities can authenticate in peer scenarios and should match the deployment design. Compare both peers: asymmetric policy, stale peer certificates, or certificate-validation differences can produce a failure that appears only in one connection direction.
What to inspect
- PKU2U policy on both peers and whether the intended scenario actually requires online-identity peer authentication.
- The certificate selected by each peer, its chain, validity, key usage and revocation-validation result.
- NegoExts/SSPI events and which certificate-processing step failed before the PKU2U context terminated.
References
- Microsoft: PKU2U authentication overview
- Microsoft: Allow PKU2U authentication requests policy
- Microsoft: SSPI architecture
- RFC 4556: PKINIT
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.