I'm in the process of moving some sites from an IIS 7.5 web server (2008 R2) to an IIS 8.5 server (2012 R2) and one in particular is giving me a fit.
The site uses client certs for authentication. User info is stored in a DB and the app is not connected to AD at all.
I have the SSL set to Require SSL and Client certificates is set to Require as well. The root CA cert is in the Local Computer's Trusted Root CAs, the site has a valid SSL cert and correctly prompts the user for their client cert. However, I receive a 403.16 response complaining that the server does not trust the client certificate.
I have made sure all non-self-signed certs were moved from Trusted Root CAs to Intermediate CAs, have compared the site configurations between the two servers and have tried setting SendTrustedIssuerList = 0 in the registry. None of these seems to do the trick.