|
1 | 1 | --- |
2 | | -# Required metadata |
3 | | -# For more information, see https://review.learn.microsoft.com/en-us/help/platform/learn-editor-add-metadata?branch=main |
4 | | -# For valid values of ms.service, ms.prod, and ms.topic, see https://review.learn.microsoft.com/en-us/help/platform/metadata-taxonomies?branch=main |
5 | | - |
6 | | -title: 'AADSTS50017: Validation of Given Certificate for Certificate-Based Authentication Failed ' |
7 | | -description: 'AADSTS50017: Validation of Given Certificate for Certificate-Based Authentication Failed ' |
8 | | -author: Laks1 # GitHub alias |
9 | | -ms.author: laks # Microsoft alias |
| 2 | +title: Error AADSTS50017 - Validation of Given Certificate for Certificate-Based Authentication Failed |
| 3 | +description: Provides solutions to the Microsoft Entra authentication AADSTS50017 error that occurs when you access an application or resource with certificate-based authentication (CBA). |
| 4 | +ms.reviewer: laks, joaos, willfid, v-weizhu |
10 | 5 | ms.service: entra-id |
11 | | -ms.topic: troubleshooting-problem-resolution |
12 | | -ms.date: 02/10/2025 |
13 | | -ms.subservice: authentication |
| 6 | +ms.date: 02/18/2025 |
| 7 | +ms.custom: sap:Issues Signing In to Applications |
14 | 8 | --- |
15 | | -# Error AADSTS50017 - Validation of Given Certificate for Certificate-Based Authentication Failed |
| 9 | +# Error AADSTS50017 - Validation of given certificate for certificate-based authentication failed |
16 | 10 |
|
17 | | -This article discusses scenarios where the AADSTS50017 error occurs when a user accesses an application or resource with certificate-based authentication (CBA). |
| 11 | +This article provides solutions to the Microsoft Entra authentication AADSTS50017 error that occurs when you access an application or resource with certificate-based authentication (CBA). |
18 | 12 |
|
19 | 13 | ## Symptoms |
20 | 14 |
|
21 | | -When a user tries to access an application or resource with Certificate-Based authentication ( CBA) the sign-in process fails, and the following error message is displayed: |
| 15 | +When you try to access an application or resource with CBA, the sign-in process fails and the following error message is displayed: |
22 | 16 |
|
23 | 17 | > AADSTS50017: Validation of given certificate for certificate based authentication failed. |
24 | 18 |
|
25 | | -## Scenario 1: Certificate chain failures due to missing CA Certificates in store or validation failures with SKI and AKI Values |
| 19 | +## Cause 1: Certificate chain failures or validation failures |
26 | 20 |
|
27 | | -## Solution : |
| 21 | +The AADSTS50017 error might occur because of the following problems: |
28 | 22 |
|
29 | | -1. Check if issuing certificate was correctly uploaded to the trusted certificates list. A certificate chain consists of multiple certificates linked together. The end-user’s certificate can be issued by a root CA, or by a non-root CA (a.k.a. intermediate CA). |
| 23 | +- Certificate chain failures due to missing certificate authority (CA) certificates in store. |
| 24 | +- Validation failures with Subject Key Identifier (SKI) and Authority Key Identifier (AKI) values. |
30 | 25 |
|
31 | | -2. If you have a non-root Issuing CA (intermediate CA), both intermediate and root CA certificates must be uploaded to the Entra ID CA trusted store. |
| 26 | + In Public Key Infrastructure (PKI), the certificate chain validation process ensures the integrity and authenticity of the certificate chain. The SKI and AKI play crucial roles in this process. The SKI provides a unique identifier for the public key held by the certificate. The AKI is used to identify the CA that issues the certificate. |
32 | 27 |
|
33 | | -3. In Public Key Infrastructure (PKI), the certificate chain validation process ensures the integrity and authenticity of the certificate chain. Below two key identifiers play a crucial role: |
| 28 | +To resolve this issue, follow these steps: |
34 | 29 |
|
35 | | -**Subject Key Identifier (SKI):** The **SKI** provides a unique identifier for the public key held by the certificate. |
36 | | - **Authority Key Identifier (AKI):** The **AKI** is used to identify the certificate authority (CA) that issued the certificate. |
| 30 | +1. Check if issuing certificate is correctly uploaded to the trusted certificate list. |
37 | 31 |
|
38 | | -**1.1)** Check the SKI of the user’s certificate and confirm if the AKI matches any of the intermediate or root CAs it was uploaded to the trusted store. |
| 32 | + A certificate chain consists of multiple certificates linked together. The end-user's certificate can be issued by a root CA or a non-root CA (intermediate CA). If you have a non-root issuing CA (intermediate CA), both intermediate and root CA certificates must be uploaded to the Microsoft Entra CA trusted store. |
39 | 33 |
|
40 | | -It’s possible to check that information by navigating through the details of the user’s certificate and uploaded issuing CAs, as shown on the next pictures: |
| 34 | +2. Check the SKI value of your certificate and confirm if the AKI value matches any intermediate or root CA certificate that's uploaded to the trusted store. |
41 | 35 |
|
42 | | - |
| 36 | + If there is no match, your certificate or the missing CA certificate should be changed accordingly. To do this, [configure certificate authorities by using the Microsoft Entra admin center](/entra/identity/authentication/how-to-certificate-based-authentication#configure-certificate-authorities-by-using-the-microsoft-entra-admin-center). |
43 | 37 |
|
| 38 | + To get the SKI and AKI values, check the details of your certificate and uploaded issuing CA certificates. |
44 | 39 |
|
45 | | -1. **Root CA Certificate:** |
46 | | - - Has its own SKI. |
47 | | - - Issues the Intermediate certificates (when applicable). |
48 | | - - The Root Certificate will not contain the Authority Key Identifier (AKI) field |
| 40 | + :::image type="content" source="media/error-code-aadsts50017-certificate-based-authentication-failed/certificate-chain.png" alt-text="Screenshot that shows a certificate chain." lightbox="media/error-code-aadsts50017-certificate-based-authentication-failed/certificate-chain.png"::: |
49 | 41 |
|
50 | | -2. **Issuing or intermediate CA Certificate (when applicable):** |
51 | | - - AKI points to the Root CA’s SKI. |
52 | | - - Has its own SKI that will match the AKI on the user’s certificate. |
53 | | - - Issues the user’s Certificate. |
54 | | - - Multiple intermediate CAs can exist. |
55 | | - - Issues the Intermediate certificates (when applicable). |
| 42 | + |Certificate type|Characteristic| |
| 43 | + |---|---| |
| 44 | + |Root CA certificate|It has its own SKI. It can issue the intermediate certificates when applicable. It doesn't contain the AKI field.| |
| 45 | + |Issuing or intermediate CA certificate (when applicable)|Its AKI points to the Root CA certificate's SKI. It has its own SKI that matches the AKI on a user certificate. It can issue user certificates, and issue intermediate certificates when applicable. Multiple intermediate CA certificates can exist.| |
| 46 | + |End-Entity (User or Client) certificate|It has its own SKI. Its AKI points to the issuing CA certificate's SKI.| |
56 | 47 |
|
57 | | -3. **End-Entity (User or Client) Certificate:** |
58 | | - - Has its own SKI |
59 | | - - AKI points to the Issuing CA’s SKI. |
| 48 | +## Cause 2: Invalid certificates |
60 | 49 |
|
61 | | -**1.2)** If there is no match, the missing CA certificates or the user’s certificate should be changed accordingly. Details under [Configure Certification Authorities using the Microsoft Entra Admin Center ](/entra/identity/authentication/how-to-certificate-based-authentication#configure-certification-authorities-using-the-microsoft-entra-admin-center). |
| 50 | +If any certificates in the certificate chain are missing valid extension identifiers, such as certificate policy extensions, the AADSTS50017 error might occur. |
62 | 51 |
|
| 52 | +To resolve this error, validate the certificate policy extensions for all certificates within the certificate chain, including user certificates, intermediate CA certificates, and the root CA certificate. Ensure that the certificate policy extension and its Object Identifiers (OIDs) are consistent and valid across the entire chain. |
63 | 53 |
|
64 | | -## Scenario 2: Invalid CAs Where the Issuer Does Not Carry Valid Extension Identifiers. |
| 54 | +To verify the policy OIDs for consistency and validity, retrieve the relevant certificates in chain and validate them as shown below: |
65 | 55 |
|
66 | | -The AADSTS50017 error may also occur if any certificates in the chain are missing valid extension identifiers, such as certificate policy extensions. |
| 56 | +:::image type="content" source="media/error-code-aadsts50017-certificate-based-authentication-failed/certificate-policies.png" alt-text="Screenshot that shows certificate policies." lightbox="media/error-code-aadsts50017-certificate-based-authentication-failed/certificate-policies.png"::: |
67 | 57 |
|
68 | | -## Solution : |
69 | 58 |
|
70 | | -2.1) Validate the Certificate Policies extensions for all certificates within the certificate chain, including user certificates, intermediate Certification Authority (CA) certificates, and the root CA certificate. Ensure that the Certificate Policies extension and its Object Identifiers (OIDs) are consistent and valid across the entire chain. |
| 59 | +If any certificates are missing certificate policy extensions, reissue the CA certificate or end user certificate with the appropriate certificate policy extensions embedded. |
71 | 60 |
|
72 | | - |
73 | | - |
74 | | -You can verify the policy Object Identifiers (OIDs) for consistency and validity by retrieving the relevant certificates in chain and validating them as shown below: |
75 | | - |
76 | | - |
77 | | - |
78 | | - |
79 | | - |
80 | | - |
81 | | - |
82 | | - |
83 | | - |
84 | | - |
85 | | - |
86 | | - |
87 | | -If any of the certificates are missing Certificate Policies extensions, it is necessary to reissue the Certification Authority (CA) certificate or end user certificate with the appropriate Certificate Policies extensions embedded. |
88 | | - |
89 | | -For more details about [policy extension and other supported extensions](/windows/win32/seccertenroll/supported-extensions), please refer to the following article: |
| 61 | +For more information about policy extension and other supported extensions, see [Supported Extensions](/windows/win32/seccertenroll/supported-extensions). |
90 | 62 |
|
91 | 63 | ## AADSTS error code reference |
92 | 64 |
|
93 | 65 | For a full list of authentication and authorization error codes, see [Microsoft Entra authentication and authorization error codes](/entra/identity-platform/reference-error-codes). To investigate individual errors, search at https://login.microsoftonline.com/error. |
94 | 66 |
|
95 | | -[!INCLUDE [Azure Help Support](../../../includes/azure-help-support.md)] |
96 | | - |
97 | | -``` |
98 | | -
|
| 67 | +[!INCLUDE [Azure Help Support](../../../includes/azure-help-support.md)] |
0 commit comments