Certificate problem 403.7

Question

So, I have the following system: there is a client app, which requests the service as follows:

blar.ServiceSecurity wsSecurity = new blar.ServiceSecurity();
wsSecurity.Url = this.tURL + "Security.asmx";
CookieContainer cc = new CookieContainer();
wsSecurity.CookieContainer = cc;
wsSecurity.ClientCertificates.Add(X509Certificate.CreateFromCertFile(certPath));

blar.LoginResult lr = wsSecurity.Login(login, password);

then, a web-service at this.tURL + "Security.asmx"'s Login method has to get that ClientCertificate (certPath) from:

Context.Request.ClientCertificate.Certificate;

and do something with it.

There are two problems:
if IIS's configuration says Require client certificates, i get 403.7 error on calling the Login function;
if IIS's configuration says Accept client certificates, i get CryptographicException "m_safeCertContext is an invalid handle";

but, those problems happen only if client works from Windows 7 x64, when launched on Windows XP, or Windows Server 2003 even, it does just fine.

ca is installed on both machines, configuration seems completely identical in all test cases,
so my question is 'What the hell?'

Answer 1

I don't see anything immediately wrong with your code or configuration, so you might find these tools helpful in figuring out the problem yourself:

1. SSL Diagnostics for IIS (or for IIS 7, see this)
2. .NET Network Tracing
3. Fiddler HTTP(S) proxy debugger (how to decrypt SSL)
4. SSL tracing