IIS Client certificate not working. Returns 403 error

Question

I'm trying to setup IIS 8 (Windows Server 2012) to accept client certificates for a secured WebAPI endpoint. Following this post I created a self signed certificate and a client certificate:

makecert.exe -r -n "CN=MyCompany" -pe -sv MyCompany.pvk -a sha1 -len 2048 -cy authority MyCompany.cer

makecert.exe -iv MyCompany.pvk -ic MyCompany.cer -n "CN=MY Client" -pe -sv MyClient.pvk -a sha1 -len 2048 -sky exchange MyClient.cer -eku 1.3.6.1.5.5.7.3.2

pvk2pfx.exe -pvk MyClient.pvk -spc MyClient.cer -pfx MyClient.pfx -po THE_PASSWORD

I installed the root certificate MyCompany.cer on the IIS server, then on IIS Manager/SSL Settings I selected the "Accept" radio button to allow the website accept client certificates.

On the client side a have a C# test console app that loads the client cert MyClient.pfx file and calls the WebAPI endpoint:

var certHandler = new WebRequestHandler();
certHandler.ClientCertificateOptions = ClientCertificateOption.Manual;
certHandler.UseProxy = false;
var certificate = new X509Certificate2(File.ReadAllBytes(@"C:\MyClient.pfx"), "THE_PASSWORD");
certHandler.ClientCertificates.Add(certificate);
var client = new HttpClient(certHandler);
var result = client.GetAsync("https://MyServer/api/MyEndpoint").Result;
string resultStr = result.Content.ReadAsStringAsync().Result;
Console.WriteLine(resultStr);

I'm getting back a 403 error:

403 - Forbidden: Access is denied.
You do not have permission to view this directory or page using the credentials that you supplied.

I tried the same setup on my local IIS (Windows 7): Imported the MyCompany.cer file, setup SSL in IIS. This time everything works fine and the WebAPI endpoint can see the client certificate with no problem.

Any ideas?

-- Update 1

I enabled Failed REquest Tracing on IIS and I get this:

<failedRequest url="https://myserver:443/"
           siteId="35"
           appPoolId="CertTest"
           processId="7248"
           verb="GET"
           authenticationType="NOT_AVAILABLE"               activityId="{00000000-0000-0000-B0AA-0280000000E0}"
           failureReason="STATUS_CODE"
           statusCode="403.16"
           triggerStatusCode="403.16"
           timeTaken="0"
           xmlns:freb="http://schemas.microsoft.com/win/2006/06/iis/freb"
           >

If I understand right the error is 403.16. I understand that happens when the certificate on the server is not imported into the Trusted Root Certification Authorities under Local Computer. I double checked and that's not my case.

Answer 1

Check that

• On your IIS machine you have installed Server's cert issuer certificate to Trusted Root Certification Authorities under Local Computer
• On your IIS machine you have installed Client's cert issuer certificate to Trusted Root Certification Authorities under Local Computer
• On your client machine you have installed Server's cert issuer certificate to Trusted Root Certification Authorities under Windows User that runs console app
• On your client machine you have installed Client's cert issuer certificate to Trusted Root Certification Authorities under Windows User that runs console app. Or you can make sure to include all necessary certificate's chain to pfx file
• In code use X509Certificate2's ctor version with X509KeyStorageFlags.UserKeySet explicitly.

If it won't help,

1. try to open url in IE (under the same Windows User Account that runs console app).
2. open *.cer files with double click on a client machine under Windows User Account that runs console app and see what Windows says about they validity.
3. change IIS SSL settings to ignore client certificate to see if it's all good with server certificate. Try both browser and console app.

Answer 2

Have a look at the following blog post: https://configmgrblog.com/2014/02/23/configmgr-2012-r2-internet-facing-mp-windows-server-2012-r2-note/

In short: There seems to be an issue with client certificate authentication and IIS 8.x in Windows Server 2012 (R2), that might cause status code 403.16 to be returned when using client certificates. Solution:

Set registry DWORD entries under HKey_Local_Machine\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL on your server:

SendTrustedIssuerList = 0
ClientAuthTrustMode = 2

The post further mentions that if your get a 403.13 (client certificate revoked) after fixing the in initial problem (403.16), you should disable client certificate revocation check on the server. I would not recommend that. Please make sure that the CDP is correctly set in the client certificate. The CDP has to be reachable from the server and the revocation list should be valid and not outdated.