Home / server / Questions / 26648
In Process
BrettRobi
Asked: 2009-06-17 07:35:22 +0800 CST

Certificate Trusts Lists in IIS7

  • 772

I am trying to enable mutual authentication for my WebService hosted in IIS7. I have the server side cert setup and working but cannot figure out how to get a Certificate Trust List created and setup in IIS7 so that I can require and validate client side certificates.

All of my client side certs are signed by my own root cert so I need to create a CTL that contains just my root cert and then have IIS validate client provided certs against the CTL.

Can anyone shed some light on how to do this? IIS6 had a UI for assigning a CTL, but I can find nothing similar in IIS7.

Update: I have now successfully used MakeCTL in wizard mode to create a CTL with a Friendly Name. However I don't have adsutil support on my IIS7 box so via other posts elsewhere I am trying to use the 'netsh http add sslcert' command to assign the CTL to my site.

Before I could use this command I had to remove the existing SSL cert that was assigned to my site for server authentication. Then in my netsh command I specify the thumbprint of that very same SSL cert I removed, plus a made up appid, plus 'sslctlidentifier=MyCTL sslctlstorename=CA'. The resulting command is:

netsh http add sslcert ipport=10.10.10.10:443 certhash=adfdffa988bb50736b8e58a54c1eac26ed005050 appid={ffc3e181-e14b-4a21-b022-59fc669b09ff} sslctlidentifier=MyCTL sslctlstorename=CA

(the IP addr is munged), but I am getting this error:

SSL Certificate add failed, Error: 1312 A specified logon session does not exist. It may already have been terminated.

I am sure the error is related to the CTL options because if I remove them it works (though no CTL is assigned of course).

Can anyone help me take this last step and make this work?

UPDATE 01-07-2010: I never resolved this with IIS 7.0 and have since migrated our app to IIS 7.5 and am giving this another try. Per the response from Taras Chuhay I installed IIS6 Compatibility on my test server and tried the steps he documented using adsutil.vbs (which can also be found here). I immediately ran into this error:

ErrNumber: -2147023584 Error trying to SET the Property: SslCtlIdentifier

when running this command:

adsutil.vbs set w3svc/1/SslCtlIdentifier MyFriendlyName

I then went on to try the next adsutil.vbs command documented and it failed with the same error.

I have verified that the CTL I created has a Friendly Name of MyFriendlyName and that it exists in the 'Intermediate Certification Authorities\Certificate Trust List' store of LocalComputer.

So once again I am at a dead standstill. I don't know what else to try. Has anyone ever gotten CTL's to work with IIS7 or 7.5? Ever? Am I beating a DEAD horse. Google turns up nothing but my own posts and other similar stories.

Update 2/23/10 - I've confirmed with Microsoft that this is a bug with IIS 7.5, but it does work with IIS 7. Check out this link for details: http://rethinker.net/Geek/Configuration/IIS7-CTLs.htm

Update 6/08/10 - I can now confirm that KB981506 resolves this issue. There is a patch associated with this KB that must be applied to Server 2008 R2 machines to enable this functionality. Once that is installed all works flawlessly for me.

iis-7 ssl ssl-certificate

3 Answers

  1. This sounds weird but you cannot use the IIS 7.0 user interface to create a Certificate Trust List (CTL). Follow these steps to create a CTL with IIS 7.0.

    1. Use MakeCTL.exe to create the CTL. For more information on MakeCTL.exe, see the MakeCTL page on the MSDN site.

      The MakeCTL.exe tool is part of the .NET Framework SDK Version 1.1. Once you install the SDK, MakeCTL.exe appears in the following location:

    \Program Files\Microsoft.NET\SDK\v1.1\Bin

    1. After you create the CTL, you must run AdsUtil.vbs to assign the CTL identifier to the name used in MakeCTL.exe.

      adsutil.vbs set w3svc/1/SslCtlIdentifier

      where is the friendly name for the CTL used in MakeCTL.exe.

    2. Run adsUtil.vbs to set the SslCtlStoreName.

    adsutil.vbs set w3svc/1/SslCtlStoreName CA

    1. After you have run AdsUtil.vbs, stop Web services by using the following command:

    net stop HTTP /y

    1. Restart the WS3SVC service by using the following command:

    net start W3SVC

    • 1

  2. You have to install this hot fix from Microsoft

    KB981506 - it resolves this problem.

    Sorry, I didn't see the KB referenced in the answers until I posted this

    • 1

  3. Did you ensure that the CTL is created in the context of the machine? By default SSL will look in the machine context and if it can't find it there, it will give you an error (though not sure if this is the one).

    • 0