Server 2022 certificate logon fails with "hash algorithm not supported on server"

Welcome to Microsoft Q&A Forum! 

Thank you for sharing the details of your issue.

Based on the information provided, this error is generally not caused by Windows Server 2022 rejecting an RSA-2048 certificate or SHA-256/SHA-384/SHA-512 hash algorithm. Windows Server 2022 supports these algorithms by default. The message "The hash generation for the provided hash version and the provided hash type is not supported on the server" is more commonly associated with a problem in the smart card authentication process, certificate mapping, or Kerberos certificate logon validation rather than a server setting that explicitly blocks a supported hash algorithm.

To further troubleshoot the issue, I recommend reviewing the following areas:

1. Verify the certificate template

• Confirm the certificate contains the Smart Card Logon EKU (1.3.6.1.4.1.311.20.2.2).
• Confirm it includes a valid UPN in the Subject Alternative Name (SAN).
• Verify the certificate chains successfully to a CA trusted by the domain controllers.

2. Validate smart card logon prerequisites

• Ensure the issuing CA certificate is published to the NTAuth store in Active Directory.
• Confirm the domain controllers possess valid Kerberos authentication certificates.
• The certificate chain can be validated on both the client and the target server.

You may also run the following command on both systems to identify certificate chain, provider, or mapping issues:

certutil -scinfo

This command can often reveal problems that are not immediately visible through the standard certificate UI.

3. Review certificate-to-account mapping requirements

Recent Windows security updates have introduced stronger certificate mapping requirements for certificate-based authentication.

If the certificate does not satisfy the required mapping or binding criteria, smart card logon can fail even when the certificate appears valid and trusted. Reviewing the certificate mapping configuration in Active Directory may help identify the root cause

4. Review the cryptographic provider used by the YubiKey

Since a YubiKey is being used, it is worth confirming:

• Whether the certificate is being accessed through the Microsoft Smart Card KSP/CNG provider or a legacy CSP.
• Whether the installed YubiKey minidriver version is fully compatible with the operating system and authentication scenario.

In some cases, hash-related errors originate from the smart card provider layer rather than from Active Directory, the CA, or Windows Server itself.

5. Review relevant event logs

The following logs may provide more detailed information about the failure:

• Applications and Services Logs → Microsoft → Windows → CAPI2
• Applications and Services Logs → Microsoft → Windows → SmartCard
• System
• Security
• Domain Controller Kerberos-Key-Distribution-Center (KDC) logs

These logs often contain the specific certificate validation, chain-building, or account-mapping error responsible for the authentication failure.

Since the certificate is RSA-2048 and you've already enabled SHA-256/384/512 support, I would focus first on certificate template configuration, NTAuth publication, certificate mapping, and KDC validation rather than looking for an additional Server 2022 setting to "accept" the hash algorithm. Windows Server 2022 supports these algorithms by default.

For further information, please visit: Disable weak cryptographic algorithms in certificate validation on Windows and Windows Server | Microsoft Learn

Smart Card Group Policy and Registry Settings | Microsoft Learn

If this answer was helpful, please Accept the Answer. Thank you for choosing Microsoft Q&A to raise your concern