Fix 0x8009035A SEC_E_KDC_CERT_EXPIRED smart card logon

Smart card logon fails after domain controller cert expires. Re-enroll the KDC cert or bump the validity period. Quick fix: check cert in AD CS console.

When this error hits

You're trying to log into a Windows 10 or 11 machine with a smart card. You get the error 0X8009035A (SEC_E_KDC_CERT_EXPIRED). The card itself is fine. The reader works. But the domain controller won't accept the cert. This usually happens after a certificate authority (CA) renewal or when the KDC certificate on your domain controller expires without getting replaced. I've seen this most often on Windows Server 2016 and 2019 after a CA server rebuild or when the default template's validity period kicked in too short.

What's really going on

The domain controller (DC) uses a special certificate for Kerberos authentication — the KDC certificate. This cert is what validates smart card logons. When it expires, Kerberos throws a tantrum and returns that SEC_E_KDC_CERT_EXPIRED error. The culprit here is almost always one of two things: the KDC certificate itself expired, or the DC's machine certificate (used for PKINIT) expired. The fix is straightforward: re-enroll the cert or force a renewal. Don't bother with group policy tweaks — they rarely help here.

Fix 1: Re-enroll the KDC certificate

Log into your domain controller as a domain admin. Open an elevated PowerShell or cmd prompt.
Run certlm.msc to open the local machine certificate store. Look under Personal > Certificates. Find the one with "Domain Controller" in the template name or "KDC" in the enhanced key usage. Check its expiration date.
If it's expired or expiring within 24 hours, run this command to force renewal:
```
certutil -pulse
```
This triggers a certificate auto-enrollment for the machine. Wait 30 seconds then refresh the console.
If the cert still shows expired, delete it manually (right-click, Delete), then run:
```
gpupdate /force
certutil -pulse
```
The DC will request a fresh KDC certificate from your CA.
Verify the new cert shows a valid date. Reboot the DC if you deleted the old one — sometimes Kerberos caches the old cert.

Fix 2: Extend the certificate validity period

If your DC cert keeps expiring prematurely, the default template might have a short lifetime. The Domain Controller certificate template defaults to 2 years. That's fine for most places, but if your CA was rebuilt or you're using a test environment, it can cause issues. To check and extend:

On your CA server, open the Certificate Templates console (certtmpl.msc).
Find the "Domain Controller" template. Right-click it and choose Properties.
Go to the General tab. Set the Validity period to 5 years (or whatever fits your policy).
Go to the Request Handling tab. Make sure "Allow private key to be exported" is unchecked — you don't want that.
Click OK. Then in the Certificate Templates console, click Action > New > Certificate Template to Issue, and select the updated Domain Controller template.
Back on the DC, force enrollment again: certutil -pulse. The new cert will have the longer lifetime.

What to check if it still fails

CA server is up? If the CA is offline, the DC can't request a new cert. Check services.msc for Active Directory Certificate Services. Restart it if needed.
Permissions on the template? The Domain Controllers security group needs Read and Enroll permissions on the template. Open the template properties, Security tab, and add "Domain Controllers" with Enroll checked.
Cert chain broken? The DC cert must chain to a trusted root. If your CA's root cert expired or was replaced, the DC cert will be invalid. Check the CA's own cert expiration in the CA console.
Time sync? Kerberos is picky about time. If the DC's clock is off by more than 5 minutes, cert validation fails. Run w32tm /query /status on the DC to verify.
Smart card itself? Try a different card from the same batch. Rare but happens — cards can have expired certs too. Check the card's cert via certutil -scinfo with the reader attached.

If none of that works, open Event Viewer on the DC under Applications and Services Logs > Microsoft > Windows > CertificateServices > Client-Lifecycle-System. Look for warnings about enrollment failures. That'll point you right to the problem.