-3

I have a client certificate from startssl. I can login to their control panel with that certificate and Firefox.

But with my asp.net website I am NOT prompted for the certificate only when using IE or Chrome not Firefox.

I did second test on another pc so I looked at FF certificate authority. I can see that intermediate ca are missing. Why FF doesn't download them automatically ? Is there something to configure on IIS for that ?

Update: I found this http://forums.mozillazine.org/viewtopic.php?f=38&t=474407 about certificates chain. Can IIS force to send back whole chain ?

How did startssl did because they automatically install my client certificate ?

0

1 Answer 1

1

You can set firefox to prompt you every time a client certificate is requested in the encryption panel in preferences. This should aid in troubleshooting.

It isn't necessary for a browser to download intermediate certificates, because any server that has a certificate issued will normally send the entire chain, starting with the server certificate and ending in the CA. The browser validates this chain to the CA certificate, and then checks whether that certificate is a trusted CA. The intermediate certificate need not be explicitly trusted (or stored), because it is signed by a trusted CA.

You may need to set IIS to require, instead of just accept, a client certificate, if you didn't already.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .