Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am supporting a Classic ASP application that connects to a payment gateway via HTTPS. Up until recently there have been no issues. A few days ago this broke without the code, IIS config or anything local changing. Its broken on at least 3 separate servers. The last run of Windows Updates was in late November, but bringing the servers' updates up date has not resolved the problem. A code snippet is below.

Dim oHttp
Dim strResult
Set oHttp = CreateObject("MSXML2.ServerXMLHTTP")
oHttp.setOption 2, 13056 "POST", SOAP_ENDPOINT, false
oHttp.setRequestHeader "Content-Type", "application/soap+xml; charset=utf-8"
oHttp.setRequestHeader "SOAPAction", SOAP_NS + "/" & SOAP_FUNCTION

Below is a dump of the error object :-

Number: -2147012852
Description: A certificate is required to complete client authentication 
Message: A certificate is required to complete client authentication

I initially posted the question on Stackoverflow ( thinking it was a code issue, but further investigation seems to point to a server issue.

share|improve this question

closed as off-topic by Greg Askew, womble Nov 29 '15 at 1:26

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

I'm helping to troubleshoot this, hence my edit. – ThatGraemeGuy Feb 13 '12 at 16:00
If nothing changed at your end, then something changed at the other end -- to now require TLS client certificate authentication. Go talk to whoever runs the server at the other end. – womble Nov 29 '15 at 1:26

This is really a long shot, but since you haven't stated the version of MSXML installed on the server, here goes:

  1. Open the Certificates MMC for the local computer store
  2. Navigate to Personal -> Certificates
  3. Take notice of any certificates that might recently have expired

If any certificates have recently expired, this might have caused the issue.

The problem is that because SSL is poorly implemented in the 3.0 version of the MSXML parser (msxml2.lib), the ServerXMLHTTP object expects any SSL connection to require both server and client certificate authentication, even though the server requested does not require client certificate authentication.

If the xml parser cannot present a valid client certificate (invalid because of expiration for example), it simply throws an error.

This is a REALLY old bug (fixed in MSXML 3.0 SP2, november 2005), and this kb article describes a workaround:

share|improve this answer
There are no personal certificates for the computer accounts on any of the affected servers. We've seen that bug and we've tried using ServerXMLHTTP.4.0/6.0, to no avail. I also considered that the 3rd party might've renewed or otherwise changed their cert, but they have confirmed that this isn't the case, and we've also been able to reproduce the error using HTTPS URLs from completely different remote sites. – ThatGraemeGuy Feb 17 '12 at 7:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.