Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've a ASP.Net Webapp running on IIS7.5. The Webserver is configured to accept Client Certifcates. Unfortunately Visitors with Safari Browser are unable to view the Page. Same Problem as described under the following link: http://www.mnxsolutions.com/apache/safari-providing-an-ssl-error-client-certificate-rejected%E2%80%9D-when-other-browsers-work.html Does anyone knows how to solve this?

I'd really appreciate your help.

edit: Seems to be the same problem: http://superuser.com/questions/231695/iis7-5-ssl-question-safari-users-get-a-prompt-of-certificate-to-select

share|improve this question

2 Answers 2

Although the webserver is set to accept certificates, have you:

(A) created a trust relationship to the client certificates in question on the server?

(B) created mappings to those specific certificates on IIS?

(C) created a trust relationship to the server certificates in question on the clients?

(D) ensured that the safari clients have an updated list of root CAs, having a path back to above certificates in question?

References:

A - http://forums.iis.net/p/1166684/1940339.aspx

B - http://learn.iis.net/page.aspx/478/configuring-one-to-one-client-certificate-mappings/

C - Depends on the operating system in question. Safari on Windows uses the Windows trust store, for OS X http://docs.info.apple.com/article.html?path=Mac/10.5/en/11871.html

D - http://www.techrepublic.com/blog/mac/managing-ssl-certificate-authorities-on-os-x/314

share|improve this answer

The OP in the Super User question that was linked has solved this:

OK, that does resolve this issue. Safari is the only browser which prompts the certificate selection. It isn't even required in IIS. Strict apple ppl :P but setting SSL client certificates to ignore does resolve it.

Seems like Accept means that it will check it and Ignore that it won't check it.

So I think "ignore" means "accept the certificate" and "accept" means "check the certificate".

share|improve this answer
    
Nope. Ignore means ignore. You can set ignore only you if don't need client certificate at all. –  x2. Apr 5 '12 at 3:25
    
@x2: So, the OP said same problem twice while it's actually not the same problem? Confusing... –  Tom Wijsman Apr 5 '12 at 7:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.