Error 0x80090318 is the Windows SSPI status SEC_E_INCOMPLETE_MESSAGE: the security provider has not received enough data to finish processing a message. In an application’s normal SSPI loop, this can be temporary; if a connection repeatedly fails, the right fix depends on whether the error comes from Wi-Fi, a VPN, Remote Desktop, HTTPS, LDAPS, or an application. Start by identifying that connection rather than changing registry or TLS settings at random.
What error 0x80090318 means
Microsoft defines 0x80090318 as SEC_E_INCOMPLETE_MESSAGE. The input security message is incomplete, so its signature cannot yet be verified. With SSPI, the application may need to read more data and try again; Schannel can return the same status when a stream read contains only part of the TLS data it needs. Microsoft’s AcceptSecurityContext documentation and its Schannel buffer guidance describe this behavior.
The code alone does not identify the root cause. It does not by itself mean that a password is wrong, Windows is corrupted, or a certificate has expired. A recurring failure may involve a broken handshake, certificate configuration, incompatible TLS settings, or a client, server, proxy, firewall, RADIUS service, or application that mishandles the connection.
Find which connection is failing
Note the application or service, exact error text, event source and ID, client and server Windows versions, and whether one device or many are affected. Record whether it began after a Windows, certificate, VPN, firewall, or server change. The location narrows the investigation:
#1 Best Overall
- 🪟【Perfect 6 in 1 screen repair kit】 Our window screen kit is more comprehensive and professional than other kits in the market. One kit is enough for you to easily install a screen window. HOOK - can remove old spline. Spline - can put in screen. CLIPS - can Fix Screen. Bearing ROLLER - can be convex to press, concave to roll it. Fiberglass SCREEN MESH + Professional Tools. Installation can be completed in just a few steps, easily DIY. Just buy once, in one step, a must at home.
- 🪟【Effective screen and visibility】 ① The length of 48 "× 118 "is enough for multiple uses, free to DIY. Suitable for all kinds of windows or doors at home. ②Standard mesh 18 X 16 weave, keeps mosquitoes、insects from entering buildings. ③ Carbon black color ensures light transmission while protecting privacy. ④ Fiberglass, edge won't be scattered after cutting, ⑤ flame retardant, stop burning in 5s to ensure your safety. ⑥ The attached dust can be washed off with water. ⑦ Material is durable, so you don't have to worry about pets scratching the screen window at home.
- 🪟【2pcs Screen Bearing Roller ] Our kit includes steel roller and nylon roller. Most of the screen rollers on the market are simple, but ours are made of a bearing structure, which is stronger, smoother, and has a longer service life.Metal roller -Recommended to install metal mesh. Nylon roller-Recommended to install fiberglass mesh, The screen rolling tool has a double side, convex wheel, and concave wheel. Two kinds of rollers can meet a wider range of needs.
- 🪟【Sufficient Screen Spline&Clip】𝐕𝐈𝐍𝐘𝐋 𝐒𝐏𝐋𝐈𝐍𝐄 -50 ft length can install more screens. This spline has high tensile strength and will not break. The hollow design is easy to press into the groove but also provides enough pressure to secure the screen. Diameter: 0.14 in fits most 0.12~0.16 in wide window and door screen frame grooves. 𝐒𝐂𝐑𝐄𝐄𝐍 𝐇𝐎𝐋𝐃𝐄𝐑 𝐂𝐋𝐈𝐏𝐒- 8 pcs are enough to fix a window and can be used repeatedly. Made of manganese steel and nickel-plated materials, hard and durable, with nice flexibility and smooth touch, keeping the screen fixed firmly.𝐑𝐄𝐌𝐎𝐕𝐀𝐋 𝐇𝐎𝐎𝐊 -Sharp, the aged spline can be hooked out by a screen hook.
- 🪟【Widely used & repeatedly used】Window Screens can be used many times， suitable for window screens, sliding screen doors, terrace screens, RV screens, and even aquarium parachute stands, etc., and apply to patio screens, garden screens, pool screens, porch screen, sliding door, entry door, storm door, patio door, etc. All the screen window tools are of high quality，and can be reused to help you install various windows in your home!
| Where the error appears | Investigate first |
|---|---|
| Enterprise Wi-Fi | EAP-TLS or PEAP, NPS/RADIUS, certificates, and TLS negotiation |
| VPN | EAP or certificate authentication, VPN gateway, RADIUS, and TLS |
| Remote Desktop | CredSSP, TLS, server certificate, and security-layer negotiation |
| HTTPS or IIS | Schannel, certificate binding, private-key permissions, and protocol or cipher compatibility |
| LDAP over SSL (LDAPS) | Domain-controller certificate, trust chain, hostname, and port 636 |
| .NET or custom application | SslStream, SSPI buffer handling, certificates, and intermediate certificates |
| Event Viewer only | Correlate the event with Schannel, EAP, NPS, RDP, or application activity at the same time |
| Windows Update or a consumer app | Identify the application and its event source; the code is not inherently a Windows Update-specific error |
Try safe checks before changing security settings
- Reproduce the failure once and note the time, connection type, and exact message.
- Close and reopen the affected application or service, then retry. A single occurrence may reflect an interrupted connection rather than a persistent configuration fault.
- Where practical, test another network or endpoint and compare with a known-good device using the same connection profile.
- Check date and time on both client and server. Significant clock skew can disrupt authentication, though it more commonly produces a different status, such as
SEC_E_TIME_SKEW. - Immediately after reproducing the issue, inspect Event Viewer under
Windows Logs > Systemand the relevantApplications and Services Logs > Microsoft > Windowsentries, includingEapHost,WLAN-AutoConfig,Schannel, orTerminalServices-*. Check NPS/RADIUS logs on the authentication server if applicable.
Do not disable certificate validation, TLS protections, or security layers as an initial test. An incomplete-message status returned inside an SSPI retry loop is different from a final authentication failure recorded by the application or Windows.
Check certificates when authentication uses TLS
For certificate-based Wi-Fi, VPN, HTTPS, LDAPS, or mutual-TLS connections, inspect the certificate on the side that is failing and verify its purpose, name, trust, validity, and private key. Microsoft’s EAP-TLS and PEAP certificate requirements and Windows EAP configuration guidance explain the authentication EKUs involved.
Rank #2
- Easy and Fast: Cut a suitable size or shape of the screen repair tape, then cover the tear or hole you want to repair. No tools needed and only seconds you're done! Fast and easy way to repair screens temporarily or permanent
- Ultra Strong Adhesive: This screen door repair kit was made of fiberglass and specialized glue, it is durable and will stick to any screen surface. Clean the contact part before use to make sure the screen patchs stay on the surface of your window screen and screen door for a longer time
- Wide Application: The window screen repair kit can be used both indoor and outdoor,it is waterproof and can be used normally between -4°F-158°F. It can be applied to fix tears and holes in window screens, screen door mesh repair, tent, pool screens and other mesh screen repair
- Multiple Sizes and Save money: There are 3 sizes includeded, you can choose or cut a suitable size and shape of the screen repair tape. No need to spend a lot to replace the entire screen mesh then
- Note: This window screen tape is NOT invisible and ventilated. Remember to peel off the release liner and attach the correct side to the tears and holes or it will not very sticky
Server certificate checks
- Confirm the certificate is not expired or revoked and that its subject name or SAN matches the hostname the client uses.
- Verify the client trusts the full certificate chain, including required intermediate CAs.
- For a TLS server, confirm the Server Authentication EKU is present:
1.3.6.1.5.5.7.3.1. - Confirm the certificate has a usable private key and is installed in the correct computer or service store. The service account must have access to that key.
Client certificate checks
For EAP-TLS or mutual TLS, verify the certificate is valid and trusted by the server, identifies the correct user or computer, and has an accessible private key. It should include Client Authentication EKU 1.3.6.1.5.5.7.3.2. Check that certificate-selection rules do not exclude it and that required intermediate CA certificates are available.
Use certificate tools to diagnose, not to assume a repair
Inspect a user certificate in certmgr.msc or use the appropriate computer certificate store for a machine certificate. The following commands test specific certificate properties; they do not repair a TLS connection automatically:
Rank #3
- This seal is 3/16 inch thick and Ten Feet long
- This is a Do It Yourself product! On a skill level of 1 to 10, this is a 3 or 4. You'll get a QR Code to scan for the complete video on how to do this DIY Project
- This seal is 3/16 inch thick and Ten Feet long. Measure the Gap in-between your panes of glass. This fits most RV windows.
- We'll help you make those foggy windows Crystal Clear! This is a permeant solution
certutil -verifykeyschecks whether a certificate’s private key is available.- After exporting the certificate as
serverssl.cer, runcertutil -v -urlfetch -verify serverssl.certo inspect chain validation and revocation retrieval. Microsoft documents this workflow in its LDAPS troubleshooting guidance.
If enterprise Wi-Fi or VPN authentication fails
- Confirm the client profile uses the same EAP method the server expects, such as EAP-TLS, PEAP-EAP-MSCHAPv2, or PEAP-TLS.
- Check that the client has the right user or computer certificate and that the NPS/RADIUS server presents a valid certificate with Server Authentication purpose.
- Verify that both sides trust the issuing CA and required intermediate certificates.
- Compare the failing device’s profile and certificates with a working device using the same network.
- Review EAPHost, WLAN-AutoConfig, Schannel, and NPS/RADIUS events at the failure time; check whether the problem followed a certificate renewal or Windows feature update.
Windows 11 changed EAP server-certificate validation behavior. Microsoft also documents TLS 1.3 interoperability considerations: NPS does not support TLS 1.3 at this time, and some older third-party RADIUS servers may incorrectly advertise TLS 1.3 support. The effect depends on the Windows build, EAP method, server version, and RADIUS implementation; see Microsoft’s Windows 11 EAP changes. Do not globally disable TLS 1.3 based on the error code alone. First confirm a protocol interoperability problem, then have an administrator patch or correctly configure the server, or approve a narrowly scoped protocol policy.
If HTTPS or IIS is affected
- In IIS, inspect the site’s HTTPS binding and confirm it selects the intended certificate.
- Check the certificate’s Server Authentication purpose, validity, hostname, chain, and private key.
- Verify the service account can access the private key, then correlate the failure with Schannel events.
- Check for obsolete duplicate certificates only after documenting which services depend on them. Microsoft notes that when multiple valid certificates are present in the Local Computer store, Schannel may select the first valid one it finds, potentially using the wrong certificate.
- If appropriate, test with a known-good certificate and review Microsoft’s IIS SSL certificate troubleshooting guide.
If LDAPS is affected
- Confirm the domain controller has a certificate suitable for Server Authentication, with a usable private key and a trusted chain.
- Check that the hostname used by the client matches the certificate name, and look for competing certificates that could be selected instead.
- Test LDAPS on port 636 with
Ldp.exe, then review Schannel events on both the client and domain controller. - Export the certificate and use
certutil -v -urlfetch -verify serverssl.certo check chain and revocation results.
Microsoft’s LDAPS troubleshooting article covers the port-636 test, certificate checks, and Schannel logging.
Rank #4
- This seal in the complete kit is 1/4 inch thick and ten feet long
- This is a Do It Yourself product! On a skill level of 1 to 10, this is a 3 or 4. You'll get a QR Code to scan for the complete video on how to do this DIY Project
- This seal is 1/4 inch thick. Measure the Gap in-between your panes of glass.
- We'll help you make those foggy windows Crystal Clear! This is a permeant solution
If the failure is in Remote Desktop
Determine whether one client or all clients fail. Check the RDP server certificate and private key, and correlate CredSSP and Schannel events. Confirm that server security-layer and encryption policies are compatible; review Group Policy for cipher-suite or security-layer restrictions. Avoid disabling Network Level Authentication or CredSSP except as a tightly controlled diagnostic test. Microsoft’s RDP connection troubleshooting guidance covers encryption negotiation, Schannel configuration, cipher policy, and certificate renewal issues.
If you maintain the SSPI or .NET application
An application that receives SEC_E_INCOMPLETE_MESSAGE during a handshake may need more input rather than treating the status as fatal. In an SSPI implementation, read more bytes and call the security function again as documented for AcceptSecurityContext. With Schannel, preserve and process returned extra buffers and handle TLS data fragmented across stream reads. Confirm the peer continues transmitting and that required intermediate certificates are available in the Windows certificate store.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Best Value
- Stops The Spread of Chips and Cracks - Rain-X Windshield Repair Kit Helps You Minimize The Appearance And Stop The Spread Of Chips And Cracks In Your Windshield.
- Easy To Use - Everything You Need Is Included, Takes Only Minutes With Minimal Steps. For Cracks Simply Apply Resin To Crack Then Curing Strips, Move Windshield Into Direct Sunlight And Remove Excess. Good for multiple repairs
- Durable Resin Formula - Use Durable Resin To Make Windshields Stronger Than Before, Repairing All Types Of Laminated Windshields Up To First Layer Of Windshield Glass
- For Best Results - Repairs Should Be Made As Soon As Possible After The Damage Occurs And Before The Break Has Had A Chance To Be Contaminated By Dirt Or Water
- Pro-Tip To Avoid Poor Results - Refrain From Applying Resin Too Quickly, Air Pockets Forming During The Repair Or Repairing On A Contaminated Crack As This May Compromise Your Results. Use A Gentle Touch — Too Much Pressure Can Extend The Crack Rather Than Repair It.
Capture and inspect the handshake if buffer handling does not explain the failure. Microsoft’s .NET SslStream troubleshooting guide recommends examining TLS messages with Wireshark or tcpdump and checking negotiated versions and cipher suites. Where permitted, determine whether the exchange stops at ClientHello, ServerHello, certificate, certificate request, verification, or Finished, or whether the connection closes abruptly. Packet captures can expose identities or network metadata, so follow organizational handling rules.
When to escalate—and what not to do
Ask the network, PKI, RADIUS, server, or application administrator to investigate when multiple devices fail, the problem involves infrastructure you cannot administer, a certificate renewal did not resolve it, or logs or a permitted packet capture show the server terminating the handshake. Escalation is also appropriate if a policy or cipher-suite change appears necessary, or if the issue tracks a Windows build change and a known-good build behaves differently.
- Do not use registry cleaners, generic DLL-repair tools, or PC optimizers as a fix for this SSPI status.
- Do not delete all certificates or disable certificate validation. Replace or remove only a certificate confirmed to be wrong and document service dependencies first.
- Do not enable obsolete protocols or weaken cipher policy globally. A scoped compatibility change can reduce security and should be approved, documented, and temporary.
- Do not permanently disable firewall or endpoint protection, or reinstall Windows, before identifying the failing application and event source.
Microsoft’s general Windows error-code table gives the same incomplete-message definition; the status is a clue about message processing, not a universal repair instruction.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
