Error Description

This error occurs when you attempt to establish a remote Windows PowerShell or WinRM (Windows Remote Management) session using a specific certificate thumbprint for authentication, but your command or configuration fails to explicitly instruct the WinRM client to actually transmit that client certificate.

By default, WinRM requires a specific programmatic flag called WSManFlagUseClientCertificate (or its equivalent parameter in PowerShell cmdlets) to be active whenever a certificate thumbprint is provided. Without this flag, the WinRM client detects a contradiction: you told it which certificate to use, but you did not give it permission to use client certificate authentication.

Step-by-Step Fixes

Method 1: Add the -CertificateThumbprint Parameter in PowerShell

If you are using the New-PSSession or Enter-PSSession cmdlets, you must ensure you are using the correct parameter configuration that forces the client certificate flag to activate.

1. Open PowerShell as an Administrator.
2. Modify your connection command to include both the -CertificateThumbprint and the -UseSSL parameters.
3. Run the command using this exact structure:

   \$thumbprint = "YOUR CERTIFICATE THUMBPRINT HERE"
   New-PSSession -ComputerName "TARGET COMPUTER NAME" -CertificateThumbprint \$thumbprint -UseSSL

   Note: Specifying -CertificateThumbprint natively triggers the required WSMan client certificate flags under the hood in modern PowerShell versions.

Method 2: Configure wsman Session Options Exclusively

If you are writing a script utilizing New-WSManSessionOption, you must explicitly define the authentication mechanism so the flag is passed to the WinRM subsystem.

1. Open your PowerShell script or console.
2. Create a session option object specifying Client Certificate authentication:

   \$sessionOptions = New-WSManSessionOption -ClientCertificate

3. Pass this option object into your connection command using the -SessionOption parameter:

   New-PSSession -ComputerName "TARGET COMPUTER NAME" -CertificateThumbprint "YOUR CERTIFICATE THUMBPRINT HERE" -SessionOption \$sessionOptions -UseSSL

Method 3: Map the Certificate to the WinRM Client (Local Computer Policy)

If the error persists, the local WinRM client might not be configured to allow or map client certificates properly.

1. Click the Start menu, type cmd, right-click Command Prompt, and select Run as administrator.
2. Enable client certificate authentication in the local WinRM configuration by running:

   winrm set winrm/config/client/auth @{Certificate="true"}

3. Verify the configuration change by running:

   winrm get winrm/config/client/auth

4. Ensure that Certificate = true appears in the output list.

Method 4: Verify Trusted Root and Client Certificate Location

WinRM will fail to pass the certificate flag successfully if the certificate is not located in the correct personal store or if it is not trusted by the operating system.

1. Press Windows Key + R, type certlm.msc, and press Enter to open the Local Machine Certificate Manager.
2. Navigate to Personal -> Certificates and ensure your client certificate is present here and contains a private key.
3. Navigate to Trusted Root Certification Authorities -> Certificates and ensure the root certificate that signed your client certificate is listed here.
4. Restart the WinRM service to apply system changes by running this command in your Administrator Command Prompt:

   net stop winrm && net start winrm