Previously trusted client certificate not longer trusted by IIS

I was getting the following error from iSS when testing locally a web api that requires ssl client certificates:

403.16 The client certificate used for this request is not trusted by the Web server

One way to troubleshoot is to use the certutil tool that comes with Windows. There is a verify switch that you can use to verify the public portion of the client certificate:

certutil -f -urlfetch -verify "public client cert.cer"

The tool will show any errors encountered when validating the cert, such as a failure to lookup the revocation list (CRL) of the issuer.

You can also capture the details of the client certificate, like the subject name, issuer and serial number, by adding custom fields to your IIS log. Instructions are here and the fields are under "Server Variables".

The specific issue I was having, however, is described in the answer to https://stackoverflow.com/questions/26247462/http-error-403-16-client-certificate-trust-issue . I had a Trusted Root cert that was invalid. After removing that cert from the Trusted Root Store at the computer level, the IIS was able to trust my client certificate. The interesting thing was that the Trusted Root cert I removed was not related at all to my client cert, so IIS was basically just failing because of an unrelated cert.

Comments

Mail labels and letter templates for jasperreports

The following are free (MIT license) mailing labels and letter templates for jasperreports that you can download and use in jasperserver and/or ireport: Update 3/15/2011 : I moved the Mail templates zip file here . Please consider making a small donation if the templates are of help to you, Thank you! If you need more information on how to use those templates please leave a comment in the blog.

How to create online multiplayer HTML5 games in Contruct2

Construct2 can use websockets to send and receive messages between games. By using socket-io , we can use a Node.js script as the server and my modification to the socket-io plugin for Construct2 to allow the games to synchronize data between them in real-time. There are two parts to this design: the Node.js server and the Construct2 clients (the games playing). The main part of building an online multiplayer HTML5 game is to plan: how the clients will communicate how often and what to communicate how much of the logic will go into the server and how much to the client. In my sample game, I chose to have each client own a player and have the server just relay messages: Use string messages in the form TypeOfMessage, Parameter1, Paremeter2, Parater3, etc to communicate. Have the clients send their player position about 16 times a second. Whenever their player shoots, the client needs to send a message immediately. Almost all of the game logic will...

How to get the raw data posted to a Java Servlet

While working in porting GeneCMS to Google App Engine and Silverlight , I stumble at one annoying problem: how to get the raw data that was sent by the browser via a POST. In this GeneCMS port, the silverlight client actually generates all the HTML that the server used to generate. The raw generated HTML is then sent to the GAE application, with some metadata about the generated pages. The GAE servlet then reads the posted data as a string and extract the individual generated pages. Each generated page is then saved into the GAE database to allow the CMS to server the pages. After tweking around in the wrong places, I finally found out that HttpServletRequest’s getInputStream method is an input stream to the raw data posted. So I modified my servlet to get the POST data into a string like this: String posted_data = ""; BufferedReader in = new BufferedReader(new InputStreamReader( request.getInputStream())); String line = in.readLine(); while (line != null) { posted...

Caffeinated Wisdom

Search This Blog