Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am supporting a Classic ASP application that connects to a payment gateway via HTTPS. Up until recently there have been no issues. A few days ago this broke without the code, IIS config or anything local changing. Its broken on at least 3 separate servers. The last run of Windows Updates was in late November, but bringing the servers' updates up date has not resolved the problem. A code snippet is below.

Dim oHttp
Dim strResult
Set oHttp = CreateObject("MSXML2.ServerXMLHTTP")
oHttp.setOption 2, 13056
oHttp.open "POST", SOAP_ENDPOINT, false
oHttp.setRequestHeader "Content-Type", "application/soap+xml; charset=utf-8"
oHttp.setRequestHeader "SOAPAction", SOAP_NS + "/" & SOAP_FUNCTION
oHttp.send SOAP_REQUEST

Below is a dump of the error object :-

Number: -2147012852
Description: A certificate is required to complete client authentication 
Message: A certificate is required to complete client authentication

I initially posted the question on Stackoverflow (http://stackoverflow.com/questions/9212985/cant-use-https-with-serverxmlhttp-object) thinking it was a code issue, but further investigation seems to point to a server issue.

share|improve this question
    
I'm helping to troubleshoot this, hence my edit. –  ThatGraemeGuy Feb 13 '12 at 16:00
add comment

1 Answer 1

This is really a long shot, but since you haven't stated the version of MSXML installed on the server, here goes:

  1. Open the Certificates MMC for the local computer store
  2. Navigate to Personal -> Certificates
  3. Take notice of any certificates that might recently have expired

If any certificates have recently expired, this might have caused the issue.

The problem is that because SSL is poorly implemented in the 3.0 version of the MSXML parser (msxml2.lib), the ServerXMLHTTP object expects any SSL connection to require both server and client certificate authentication, even though the server requested does not require client certificate authentication.

If the xml parser cannot present a valid client certificate (invalid because of expiration for example), it simply throws an error.

This is a REALLY old bug (fixed in MSXML 3.0 SP2, november 2005), and this kb article describes a workaround: http://support.microsoft.com/kb/302080

share|improve this answer
    
There are no personal certificates for the computer accounts on any of the affected servers. We've seen that bug and we've tried using ServerXMLHTTP.4.0/6.0, to no avail. I also considered that the 3rd party might've renewed or otherwise changed their cert, but they have confirmed that this isn't the case, and we've also been able to reproduce the error using HTTPS URLs from completely different remote sites. –  ThatGraemeGuy Feb 17 '12 at 7:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.