KDC error - Cannot find a suitable certificate to use for Smart Card Logons (Hello for Business)

[Jeff Harlow]

We have been using Hello for Business for over a year now. This morning, I come in and have users that are no longer able to login via PIN or FaceID. On review, I can see that our certificate (PKI) renewed. Everything states that the certificates are valid. For the life of me, I cannot seem to figure out why after a renewal, this would break.  Any ideas?   The date on the certificate for Kerberos, and DC Authentication are both dated today with 1YR expiration (2019 Aug)  Desktops all have valid certificates. Root certificate is valid and does not expire for like 30 years.  I even delete the DC, Kerberos certifcates, and reissued them.  Found an article about changing the RSA and merging the three certificates into one (Domain Controller Authentication (Kerberos)) and superseded the prior three. Verified that all DCs had the new certificate.  Still same error on DCs.  Please help! 

[#2]

The two errors are Error 29: The KDC cannot find a suitable certificate to use for smart card logons or the KDC could not be verified.   

Error 19: This event indicates an attempt was made to use smartcard logon, but the KDC is unable to use the PKINIT protocol because it is missing a suitable certificate.  

The original and newly created template (and certificate) includes Smart Card Logon. 

[#3]

Jeff,

I know this is an old post, but we are setting up the environment right now and experiencing the same issue.

Care to share how you solved this one?

tx!

[#4]

Unfortunately, I do not recall the solution. We have since moved to Azure AD and not even using the method at that time. Sorry. 

@Matthias Vandenberghe 

[#5]

I'd'a said to check the Issuing CA certificate was in NTAuthCertificates. Enterprise CAs put themselves there by default if installed with sufficient permissions, but sometimes they get removed for enhanced security, or not updated for other reasons. A client won't attempt smart card logon unless the Issuing CA cert (i.e. the Issuer of the DC cert) is in that store.