2

I have installed a client certificate on my client server. When making an HTTPS request from the client to target server with the client cert the IIS logs report a 500.0.64 error occurred (this is the target server's IIS log). The client application that makes the call from the client server is a .Net web site hosted in IIS.

On the target server IIS is configured to 'Require SSL' and client certificates are set to 'Require'. If I do not include the cert in the request I get a 403 Forbidden error, which is correct. If I change the client certificate setting to 'Accept' then I still get a 500.0.64 error if the cert is passed, but if it isn't then the application hosted on the target server is accessible.

As a test I created a simple console application which I placed on the client server. This uses the client cert and works perfectly fine, with the cert successfully validating on the target machine. This uses identical code to generate the http request as the web site hosted in IIS does. Therefore I've concluded the problem cannot lie with the client application, and cannot lie with the target machine - rightly or wrongly.

So why does the including the client cert in the request from the IIS hosted application cause this error whilst it is fine for the console application? Can anyone offer any advice on how to further diagnose the problem.

I have followed the advice from this answer as the scenario is virtually identical. However the registry key in question does not exist on both client and target machines so I don't believe that is the cause.

2 Answers 2

2

It turns out the aspnet user on the client did not have access to the certificate. Once I gave it read access it worked fine.

You can do this by going to the certificate in the MMC.exe console, right clicking the cert and managing the private key.

I discovered this solution having read this answer: https://stackoverflow.com/a/2859843/976866

2

After a couple of days of scanning all kind of forums I built myself this solution that worked like a charm

NEED Transform SCCM MP to https

Problems mpcontrol : Call to HttpSendRequestSync failed for port 443;SAN2 extension error; IIS log: 500 64 0

Solution For SAN2 error: Extensions: add Client authentication to the cert; Subject name - build from AD (option);

For IIS error on ISS server use this command to bind certificate: http add sslcert ipport=0.0.0.0:443 certhash="your certhash" appid="your appid" certstorename=My verifyclientcertrevocation=disable VerifyRevocationWithCachedClientCertOnly=Disable UsageCheck=Enable clientcertnegotiation=Enable

1
  • For some reason, setting the "clientcertnegotiation" to "enable" fixed my issue. Clients were having problems opening a website which requires SSL Client certs, only when using Google Chrome (version 83). Other webbrowsers were not affected. This happened on a 2008R2 server. On another machine running Server 2016 the same website is hosted with clientcertnegotiation=Disable and there are no problems whatsoever.
    – brz
    May 29, 2020 at 12:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .