Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Here's the setup: we've got a Production and a Test server, both Win2008R2 / IE9 and mostly similar in hardware/software/updates. We also have a client certificate (self-signed, private key included) given to us by our partner, which is required for accessing partner's SSL web page. On both servers we log in under some domain accountm add this certificate to CurrentUser\Personal store and check the SSL web page on port 8443 in IE.

On test server, it works fine, i.e. the page prompts for a client certificate in IE (IE is set to ask for a client cert). The certificate is self-signed, but it works nice even if not added to Trusted Root cert storage, which means that everything from partner's web server settings to our client certificate/key is OK.

The problem is our Production server - being added to CurrentUser\Personal store, the certificate is not prompted by IE when trying to gain access to the aforementioned SSL web page in IE. At first it seemed strange to me, but after checking the web page in Google Chrome it turned out that the problem isn't in the certificate or store placement - Google Chrome prompted for a client cert and opened the page, which means there are no issues with certificate/key itself.

Well, we don't need IE much, actually we need the certificate to work not in a browser, but it is required for our service. For this, we add the certificate to LocalMachine\Personal store, and the service on our Test server is able to access the web page. On the Production server, the service fails to communicate. The service is run under dedicated domain Service-Account with administrator rights on both Test and Production servers (not the best practice, but i'll have to deal with it later).

The service logs the following: Web error System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel.

To investigate it further, i logged on to Production server with Service-Account credentials, added the cert/key to the account's CU\Personal store and checked - still IE didn't ask for certificate and was unable to open the page.

I have checked all cert stores, the cert is properly imported with private key included, so no mistake here.

And yes, there are LOTS of various certificates on Production server (we have over 200 partners, each posessing his own), but no other certs signed by this particular partner, so it doesn't look like the problem is caused by a cert mess.

Sorry for being that long and somewhat chaotic in description, to sum it up:

Test server:

  • client cert\key installed in CU\Personal under my account and is accepted in IE
  • client cert\key installed in LM\Personal and is accepted when run by service

Production server:

  • client cert\key installed in CU\Personal under my account and is NOT accepted in IE, but IS accepted in Chrome
  • client cert\key installed in LM\Personal and is NOT accepted when run by service
  • when logged on as Service-Account, installed cert in CU\Personal, NOT accepted in IE but again IS accepted in Chrome, so the issue is not user-specific

That being said, the problem looks entirely machine-specific, probably something's wrong with the IE, but currently i really have no idea where to look at. It doesn't seem like IE patches or version issue, to me it looks more like some bizzare (security?) settings.

I don't see a reason for Wireshark dump here, but probably there is?

So, could anyone point me in some direction please?

Thanks a lot! =)

share|improve this question
    
Is this partner created certificate truly a self-signed cert or do they have their own internal CA? It could be a trust chain issue because of a missing CA. –  Bad Dos Jan 13 at 21:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.