Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use IIS 6 on 2003 Server.

The website use SSL. I think it works fine: when a user, on XP machine, connect to the site (https://www.my_soc.local), it obtains the first page.

My problem: I'd like now users to authenticate to the web site. I've created certificates with openssl, and installed personal certificate on XP machine. I've installed the ".p12" in "all" directories in the MMC "Certificates - User" and "Certificates - Machine", and in the web browsers (IE et Firefox). In all places, the certificate is "valid" (I've installed everywhere the certificate of the CA).

I've done configuration on IIS to have authentication: need clients certificate, mapping 1 to many (map to "administrator"), de activated "Integrated windows authentication".

When the XP try to obtain the first page now, I've a 403.7 error (this page need a user certificate) with IE 8 and Firefox 3.6.

With an "old" XP SP2, I obtain a window "Choose a certificate", but no certificate appear in the window.

In openssl, for creating and sign user certificate, I use:

keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment extendedKeyUsage = clientAuth, emailProtection

Is it possible to have a log, on the server or the client XP, to have a little more informations about the problem ?

Thanks for all.

Best regards.

share|improve this question
On your XP systems. Is the certificate issuer (CA) trusted? – iivel Aug 29 '11 at 17:02
The CA certificate is self-signed. The "way of access" of the CA certificate is "valid". All this in MMC "Certificate user" and "Certificate computer", and web explorer (IE and Firefox). For creating this certificate, I use "keyUsage = critical, keyCertSign, cRLSign", and "nsCertType = sslCA, emailCA, objCA". – Brico Aug 29 '11 at 17:48

I've found a solution.

It seems to be a problem about crl.

I've created a "crl.crl" file, and have installed in XP and 2003 Server (in "MMC Certificates - Local computer", in "Autorités intermédiaires" \ "Liste de révocation de certificats" - I prefer give here the real name in French, and not to translate and give a bad translation).

I've installed ".p12" user file in MMC Certificates "Local user": Perso \ Certificates.

I've installed ".p12" CA file in MMC Certificates "Local user" and "Local computer": Autorités de certification racines de confiance \ Certificates.

All now works fine.

Thanks for all.

Best regards.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.