I have installed a client certificate on my client server. When making an HTTPS request from the client to target server with the client cert the IIS logs report a 500.0.64 error occurred (this is the target server's IIS log). The client application that makes the call from the client server is a .Net web site hosted in IIS.
On the target server IIS is configured to 'Require SSL' and client certificates are set to 'Require'. If I do not include the cert in the request I get a 403 Forbidden error, which is correct. If I change the client certificate setting to 'Accept' then I still get a 500.0.64 error if the cert is passed, but if it isn't then the application hosted on the target server is accessible.
As a test I created a simple console application which I placed on the client server. This uses the client cert and works perfectly fine, with the cert successfully validating on the target machine. This uses identical code to generate the http request as the web site hosted in IIS does. Therefore I've concluded the problem cannot lie with the client application, and cannot lie with the target machine - rightly or wrongly.
So why does the including the client cert in the request from the IIS hosted application cause this error whilst it is fine for the console application? Can anyone offer any advice on how to further diagnose the problem.
I have followed the advice from this answer as the scenario is virtually identical. However the registry key in question does not exist on both client and target machines so I don't believe that is the cause.