Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm hosting a site in IIS 7 that's using a wildcard certificate from RapidSSL. To date there's been no issues of people not being able to connect to the site with SSL. Now we have a client who can't connect from every machine in their network. The client machines are Red Hat and Windows XP. They can make HTTP requests ok but HTTPS return a 403.16 error. Since they aren't reaching our ASP.NET code there isn't any debug info I can get from there and nothing from IIS is being logged.

The requests are coming from both a web browser and a custom piece of software sending us notifications. Neither works.

Things checked so far:

  • No errors in the Application Log
  • Verified the entire certificate chain is installed and not just the client certificate
share|improve this question

IIS is rejecting the client certificate. This generally means that your server doesn't have the CA which was used to generate the client certificates. You will need to obtain this from the client and install it on the IIS server.

See this Microsoft KB article: Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 403.16 - Forbidden"

share|improve this answer
When I view the Certification Path for the certificate IIS is using it goes GeoTrust Global CA > RapidSSL CA > Our Certificate. All 3 are installed under Computer Account and ours is under Personal, RapidSSL is under Intermediate Certification Authorities, and GeoTrust is under Trusted Root Certification Authorities. – Brian Surowiec Aug 23 '12 at 20:58
You're still looking at the server certificate. It's the client certificate that is being rejected. – Michael Hampton Aug 23 '12 at 21:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.