I am trying to implement client certificate authentication on IIS 8. I have deployed my configuration on a development machine and verified it working as expected there. However after setting up on the server, whenever I navigate to the site and am prompted for the client cert, I select it and immediately get the 403.16 error. The failed requests log gives the error code 2148204809 and message "A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider."

I have a valid client cert and also a valid CA cert. The CA cert is installed in Trusted Root Authorities on the Computer account of both the server and the client machine, and the client cert is installed in the Personal area of the Current User account on the client machine.

The client cert is signed directly by the root CA and as I said, both are valid. There are no other certs in the chain and there are no intermediate certs in the Trusted Root Authorities area.

The IIS configuration has sslFlags = SslNegotiateCert and iisClientCertificateMappingAuthentication is enabled.

The server is not configured to send a CTL and we have SendTrustedIssuerList = 0.

I cannot see why the client cert should not be trusted.

  • which certificate store did you install the certificate in on the server? – lockstock Oct 8 '14 at 1:20
  • Sorry the CA cert is in the computer account on the client and server, and the client cert in in the Current User account – Eric Oct 8 '14 at 1:26
  • does the account under which your app pool is running have permission to access the CA cert on the server? – lockstock Oct 8 '14 at 2:26
  • No, I had tried it with both the app pool identity and also the identity of a local admin account that typically administers the certs – Eric Oct 8 '14 at 3:47

I had exactly the same issue. It worked for me after I checked the "Disable Certificate revocation Lists (CRL)" in the properties of the self signed certificate in the Local computer trusted root CA store.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.