I have a 'sandbox' domain and I am experimenting with different forms of authentication. I have the following three machines in my network: Forefront TMG, IIS Web Server, ADDS. Outside of the domain I have a laptop that I am using as a client to test access over the 'Internet'.
I have published a web service over https to authenticate at Forefront using SSL Client Certificate Authentication. The client certificate is installed on the laptop and also mapped to a domain user in AD. The certificate root is trusted in 'Local Computer' on all machines in the domain. The publishing rule uses kerberos to forward the authenticated user to IIS and the web service is hosted using Windows Authentication.
The client certificate is issued from StartSSL. The domain certificates were created in IIS and signed internally.
Connecting from a browser on the laptop I am requested to select the certificate, then it says the site is not trusted but I can continue (not recommended). I continue and it asks me to select a certificate a second time. Then it returns the following error:
Error Code: 500 Internal server error. The server denied the specified URL. Contact the server administrator (12202)
Can anyone offer clues?