1

I'm hosting a site in IIS 7 that's using a wildcard certificate from RapidSSL. To date there's been no issues of people not being able to connect to the site with SSL. Now we have a client who can't connect from every machine in their network. The client machines are Red Hat and Windows XP. They can make HTTP requests ok but HTTPS return a 403.16 error. Since they aren't reaching our ASP.NET code there isn't any debug info I can get from there and nothing from IIS is being logged.

The requests are coming from both a web browser and a custom piece of software sending us notifications. Neither works.

Things checked so far:

  • No errors in the Application Log
  • Verified the entire certificate chain is installed and not just the client certificate
Brian Surowiec
  • 299
  • 1
  • 4
  • 15

1 Answers1

2

IIS is rejecting the client certificate. This generally means that your server doesn't have the CA which was used to generate the client certificates. You will need to obtain this from the client and install it on the IIS server.

See this Microsoft KB article: Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 403.16 - Forbidden"

Michael Hampton
  • 244,070
  • 43
  • 506
  • 972
  • When I view the Certification Path for the certificate IIS is using it goes GeoTrust Global CA > RapidSSL CA > Our Certificate. All 3 are installed under Computer Account and ours is under Personal, RapidSSL is under Intermediate Certification Authorities, and GeoTrust is under Trusted Root Certification Authorities. – Brian Surowiec Aug 23 '12 at 20:58
  • You're still looking at the _server_ certificate. It's the _client_ certificate that is being rejected. – Michael Hampton Aug 23 '12 at 21:01