Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a IIS web site which requires client certificate. I have turned off CRL checking. The client is unable to access the web site - he gets 403.17 (certificate expired) error.

I would like to log the certificate he is using, becaue I think he is using the wrong certificate.

Is there a way to do this? I probably can not use WireShark, because client certificatethat is passed from the client is probably already encryped.

I am running a WIndows 2003 server.

Matra

share|improve this question

3 Answers 3

No, you'll just be able to log the response code from the failed authentication. There's no way to determine which cert is being used from the server side.

share|improve this answer
    
I know that I can use Fiddler on the client side to decode SSl traffic. However, I have never used it on the server side. Any ideas? –  matra Jan 6 '10 at 19:07
    
Fiddler is an HTTP(S) proxy, your client would have to be configured to use it in their browser's proxy settings. You can't install it on the server and sniff HTTP(S) sessions promiscuously. Can't you just look at the client's machine to see what he is using for a cert? –  squillman Jan 6 '10 at 19:49
    
No I can not look at the client machine (it is acutally Java server calling our web service). Could it be possible to install fiddler on server, make it listen on standard port 443, configure web site to run on port 444 and trick fiddler to forward traffic to the new port. I've googeled and find a MS tool called SSlDiag. Any expereiunce with this tool. It claims "Real-time monitoring (SSLMon) for SSL handshakes and client certificates and supported using user interface & command-line " –  matra Jan 6 '10 at 20:05
    
It looks like fiddler can be used on the server scenario too: fiddler2.com/fiddler/help/reverseproxy.asp –  matra Jan 6 '10 at 21:08
    
Yeah, that should do it. So long as it captures the cert in question you should be good. Don't know if that is possible, though. –  squillman Jan 6 '10 at 21:21

Update to my question:

  • you can not use fiddler in reverse proxy scenario with SSl

  • you can not use Microsoft SslDiag, because it does not log expired certificate

So the only viable option is to use WireShark

share|improve this answer

The certificates are exchanged in the clear; TLS keeps track of the cleartext data and after getting the security layers up, exchanges information about that cleartext data, to confirm it wasn't tampered with.

You can use wireshark to capture the https session; the client cert should be in the first packet from client to server after the Client Hello. (Unless it is done via re-negotiation).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.