What does Windows error code 13819 (ERROR_IPSEC_IKE_INVALID_CERT_TYPE) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The certificate type was not acceptable for IKE authentication.

Previous	Next
ERROR_IPSEC_IKE_INVALID_KEY_USAGE	ERROR_IPSEC_IKE_NO_PRIVATE_KEY

ERROR_IPSEC_IKE_INVALID_CERT_TYPE

ERROR_IPSEC_IKE_INVALID_CERT_TYPE means Windows selected or received a certificate whose type does not match the requirements of the IKE authentication method or IPsec policy.

Focus on certificate selection before changing trust. The certificate can be trusted yet still be unsuitable for the authentication method because its template, key type, or intended use does not match the negotiated path.

What to check

Verify that the certificate is a machine certificate where the rule requires computer authentication.
Check the intended purpose/EKU and issuer chain against the configured IPsec certificate requirements.
Confirm that the correct certificate store is being used and that a user certificate is not being selected accidentally.

Microsoft: IKE/AuthIP authentication methods

Microsoft: Audit IPsec Main Mode

Microsoft: IPsec IKE system error codes

Looking for a different code? Search another status or error code.