i've setup a SSL certificate to use in a website i'm working on. The problem is that when "Require SSL" is checked in iis, i get the following error while trying to access the site:

403 - Forbidden: Access is denied. You do not have permission to view this directory or page using the credentials that you supplied.

If that checkbox is not checked, the site works fine (i'm not sure why, but i can even access it through SSL).

Not sure if it makes any difference, but my company has an ISA server that we use as a proxy / firewall.

Thanks, Gonzalo


The Require SSL checkbox should have 3-option radio button for "Client Certificates". What have you selected there? If you have it set to Require, then it will require client authentication and if you don't specify a client certificate, it will give you the access denied. If you set it to ignore or accept, it will not be a fatal error if you don't specify client certificate.

  • How do you specify a client certificate? – rball Apr 11 '16 at 17:46
  • Unticking "Require SSL" did the trick for me (and selecting Ignore client certificates) – Savage May 17 '17 at 10:40

IIS is not gentle about its SSL requirements. When a request comes via a non-SSL connection for an SSL-required resource, it returns a 403 instead of redirecting to the SSL page.

Manually change the address in the bar to https:// should work.

  • The problem happens accessing with SSL, with "Require SSL" checked. – Gonzalo Apr 4 '11 at 19:01

I recommend just removing port 80, only run over port 443 with SSL and the appropriate binding in place. You don't want to require SSL as that is for client side connections.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.