Background: I have a website which has, for a particular subdirectory, client certificate mapping set up in IIS6 for download of certain privacy-protected files. There are two independent clients that use the download, and it was all set up and working nicely as of several months ago. Server's SSL certificate and client digital ID certificates all provided by Verisign.
Then, one of the client certificates expired, of course. I downloaded the public certificate from Verisign again like last time, installed the new (more bits!) intermediate certificate and the client certificate shows as "valid" on the server. The client side (an ocean away) also installed the new intermediate certificate and shows as valid on the client side. Did what we did to make it work before, right? Except the new client certificate has always thrown a 403.16 error, "Client certificate is ill-formed or is not trusted by the Web server."
Going over and over the certificates, I have noticed that the new one has a line that reads "OU = Digital ID Class 1 - Netscape Full Service" where as both the old expired one from this client and the still-working one for the other client read "OU = Digital ID Class 1 - Microsoft Full Service". So, what is the difference? Will using a Netscape digital ID that you have somehow installed into IE (what I suspect is happening) cause exactly this problem? The client says they have talked to Verisign and Verisign said they are "the same". Uh huh. If they are so much the same then why is the first step in signing up for a Verisign digital ID to choose either IE or Netscape?
Pointers to some documentation on this issue would be appreciated. I can't seem to google up any. Is this because most people realize that installing a Netscape certificate into IE probably won't work?
I have my own client certificate that is not provided by Verisign, which I have been able to install appropriate intermediate certs and make work for this subdirectory/mapping as a test - but I'm pretty sure that if there's a choice between IE and Netscape types of certificate, this particular organization providing the certificate would have chosen IE. I used IE6 for this testing.