HTTP Error 403.7 - The client certificate was missing or unrecognized
Message :
The page you are attempting to access requires your browser to have a Secure Sockets Layer (SSL) client certificate that the Web server recognizes.
Cause :
- No certificate was sent to the webserver
- or a certificate was sent to the webserver and the webserver rejected it.
Solution :
You MUST close your browser before any other authentication attempt to force a new SSL connection.
If the browser prompted for a certificate and the dialog has not been cancelled that means that a certificate has been sent to the webserver.
If the dialog is not shown at all, that means that Windows didn't recognize the certificate you wanted to use.
To make appear the dialog :
- Check that the policy "don't prompt for client certificate selection when no certificate or only one certificate exists" is disabled. It can be found in the custom "security level" settings for a internet/intranet zone
- Check that the certificate is compliant. It should have the Enhanced Key Usage (EKU) "Client Authentication (1.3.6.1.5.5.7.3.2)".
To add the smart card certificate to the dialog :
- Check that the smart card is present
- Check that the smart card certificate is found by the browser.
It should be present in the "Personal" folder on the user certificate store (certmgr.msc)
If it is not present, check that the "certificate propagation service" is running
- Check that the smart card certificate is trusted by the browser
Double click on the certificate found in the previous step
Open the certificate properties, select the tab "certification path" and search for the label "the certificate is ok"
- Check that the certificate has the Enhanced Key Usage (EKU) "Client Authentication (1.3.6.1.5.5.7.3.2)"
To check that the smart card certificate is trusted by the webserver :
- Check that the root certificate which signed the smart card certificate is trusted on the webserver.
Extract the root certificate by double clicking on it on the "certification path" of the smart card certificate.
Check its presence on the webserver in the folder "trusted root certification authorities" in the "computer certificate store" (and not in the "user certificate store").
More information :
http://support.microsoft.com/kb/186812