HTTP 403.13 - Forbidden: Client certificate revoked

Harsha

unread,

Apr 21, 2004, 1:11:02 AM4/21/04

to

Hi,
We are trying to host a secure webservice over IIS 5.0 using server and client authentication certificates.
Here are the details of the steps we followed to setup Client Authent:

1) Created a server certificate request and submitted the same to Verisign.
2) Installed the Verisign supplied test(trial) server ceritificate on the server.
3) Installed the Test CA root certificate on both the server and the client.

At this point we were able to get the secure webservice accessible through HTTPS with only server authentication.

4) Created a client certificate request and submitted the same to Verisign.
5) Installed the Verisign supplied test(trial) client certificate on the client.
6) Enabled the 'Require Client Certificates' option in the IIS Directory Security for the Virtual Directory where the webservice components(Activex DLL, wsdl, wsml etc) are placed.

At this point when we tried to access the Webservice, we get a 'HTTP 403.13 - Forbidden: Client certificate revoked' error.
We even tried to access the wsdl file using browser by typing in https://<server>:8443/<VirtualDirectory>/Server/server.wsdl, but we get the same error even with the HTTP GET method which again says - HTTP 403.13 - Forbidden: Client certificate revoked.

We later read an article in msdn (Article no. 294305) which talks abou this error.
We later retrievd the CRL(Certificate Revocation List) rom verisign (http://crl.verisign.com/SecureServerTestingCA.crl) and verified that the serial no. of our client certificate is not listed in the CRL, so this confirms that the certificate has not been revoked.

Any idea why we get this error message still ?

Any help in this regard is greatly appreciated.

Thanks in advance...

Thanks & Regards,
Harsha.

rao202

unread,

Nov 9, 2005, 3:45:42 AM11/9/05

to

Hi,

We are developing a web application that use mutual authentication and
encountered the same problem.

The IIS replies that the client certificate is revoked, but we check
the CRL points of entry and they are accesible.

In a second phase we install the first (top) CRL suggested in the
server, and obviously we check that the test certificate is not in the
list, but the problem persist.

Any ideas of the problem or suggestions?? Thank you.

--
rao202
------------------------------------------------------------------------
rao202's Profile: http://www.highdots.com/forums/m1414
View this thread: http://www.highdots.com/forums/t682534

taddub

unread,

Nov 11, 2005, 6:59:42 AM11/11/05

to

Hi

Did you ever manage to solve this as I am having the same problem.

Cheers

Tad

Sebas

unread,

Nov 11, 2005, 7:08:33 AM11/11/05

to

Hi !

We recently had some problems in IIS when using certificate
authentication in a .NET application to connect with IIS.

Have a look at :
http://groups.google.com/group/microsoft.public.inetserver.iis/browse_frm/thread/fc4c937bbeef5c56/850b4f873fc4c27c?lnk=st&q=UploadReadAheadSize&rnum=12#850b4f873fc4c27c

ohaya

unread,

Nov 11, 2005, 8:04:40 AM11/11/05

to

Hi,

MS has a couple of tools that might help you diagnose the problem:

SSLDiag:
http://www.microsoft.com/downloads/details.aspx?FamilyID=cabea1d0-5a10-41bc-83d4-06c814265282&displaylang=en

AuthDiag:
http://www.microsoft.com/downloads/details.aspx?familyid=E90FE777-4A21-4066-BD22-B931F7572E9A&displaylang=en

I haven't used AuthDiag myself, but when you run SSLDiag, it shows a
bunch of IIS settings and info, which might highlight something. Also,
I think that it has a way to act as the SSL client end.

Another possible tool is to use OpenSSL 'sclient'. When you run that,
it shows all of the client-server dialog, and you might find something
there.

When you said that "we install the first (top) CRL in the server", what
did you mean by that (install in the server)? Also, since you indicated
"top", is there a subCA/intermediate CA(s) involved? If so, have you
checked the sub/intermediate CAs CRLs to see if your client cert is in
them?

Jim

Vibhu Gupta

unread,

Apr 12, 2010, 7:50:27 AM4/12/10

to

I am also facing HTTP 403 Forbidden Error while configuring Mutual SSL authentication in IIS. PLease help me.

From http://www.developmentnow.com/g/59_2004_4_0_0_275257/HTTP-403-13--Forbidden-Client-certificate-revoked.htm

Posted via DevelopmentNow.com Groups
http://www.developmentnow.com/g/