NavClientInvalidCredentialException

Djemo

I am unable to connect BC clients.

I have a three tier Dynamics 365 Business Central 2026 on-prem installation, with sql, web server and nst on separate servers. I need help figuring out why the delegation fails

I run all three services from dedicated domain accounts : sqlsvc, websvc, nstsvc

SQL:

MSSQLSvc/SqlSrerverFQDN:1433 domain\sqlsvc

NST:

http/NstServerFQDN domain\nstsvc 

Web:

http/bc.domain.local domain\websvc   (bc.domain.local is the link that users will use). 

Delegation is configured like this:

For domain\websvc user (running BC Web Server), the following is added to the list of services trusted for delegation:

http domain\nstsvc

For domain\nstsvc user (running service tier), the following is added to the list of services trusted for delegation:

MSSqlSvc domain\sqlsvc

I have certificates on all servers and everything is correctly configured in regards to certificates. When I try to connect the user I get the error NavInvalidClientCredential. The user is added as superuser. I combed over all configuration documentation and pretty sure everything is configured as recommended.
Any suggestions to what I can check here?