openssl, IIS, XP and error 403.7

Question

I use IIS 6 on 2003 Server.

The website use SSL. I think it works fine: when a user, on XP machine, connect to the site (https://www.my_soc.local), it obtains the first page.

My problem: I'd like now users to authenticate to the web site. I've created certificates with openssl, and installed personal certificate on XP machine. I've installed the ".p12" in "all" directories in the MMC "Certificates - User" and "Certificates - Machine", and in the web browsers (IE et Firefox). In all places, the certificate is "valid" (I've installed everywhere the certificate of the CA).

I've done configuration on IIS to have authentication: need clients certificate, mapping 1 to many (map to "administrator"), de activated "Integrated windows authentication".

When the XP try to obtain the first page now, I've a 403.7 error (this page need a user certificate) with IE 8 and Firefox 3.6.

With an "old" XP SP2, I obtain a window "Choose a certificate", but no certificate appear in the window.

In openssl, for creating and sign user certificate, I use:

keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment extendedKeyUsage = clientAuth, emailProtection

Is it possible to have a log, on the server or the client XP, to have a little more informations about the problem ?

Thanks for all.

Best regards.

Answer 1

I've found a solution.

It seems to be a problem about crl.

I've created a "crl.crl" file, and have installed in XP and 2003 Server (in "MMC Certificates - Local computer", in "Autorités intermédiaires" \ "Liste de révocation de certificats" - I prefer give here the real name in French, and not to translate and give a bad translation).

I've installed ".p12" user file in MMC Certificates "Local user": Perso \ Certificates.

I've installed ".p12" CA file in MMC Certificates "Local user" and "Local computer": Autorités de certification racines de confiance \ Certificates.

All now works fine.

Thanks for all.

Best regards.