CODEWITHSUNDEEP
iishttpsiis-8
Fony Fazoulyanov
Fony Fazoulyanov

Reputation: 155

Authorize failed when any not-self-signed certificate exists in trusted root certification authorities

I've faced this problem when deploying my web service on IIS. I set up https protocol and binded certificate. But authorization did not work and iis returned 403 error. Authorization had worked after deletion the only cross-certificate out of trusted root certification authorities. Issuer of this cross-certificate was also in trusted root certification authorities. Is it normal behavior?

Upvotes: 0

Views: 736

Answers (1)

Bruce Zhang
Bruce Zhang

Reputation: 3042

Yes, it is normal.

If you can reproduce the issue, please check the sub status code of 403 error. I think it may be 403.16.

One cause for this error is that non-self-signed certificates are in Trusted Root.

There are one or more non-self-signed certificates in the Trusted Root Certification Authorities Certificate store. A non-self-signed certificate is any certificate for which the Issued To and Issued By values aren't an exact match.

Resolution is moving any non-self-signed certificated out of the Trusted Root Certification Authorities Certificate store and into the Intermediate Certification Authorities Certificate store.

Upvotes: 2

Related Questions