title: IIS Client certificate not working. Returns 403 error
body: <p>I'm trying to setup IIS 8 (Windows Server 2012) to accept client certificates for a secured WebAPI endpoint. Following <a href="http://woloski.com/2012/08/04/securing-aspnet-webapi-with-clientcerts/" rel="noreferrer">this post</a> I created a self signed certificate and a client certificate:</p>
  
  <pre><code>makecert.exe -r -n "CN=MyCompany" -pe -sv MyCompany.pvk -a sha1 -len 2048 -cy authority MyCompany.cer
  
  makecert.exe -iv MyCompany.pvk -ic MyCompany.cer -n "CN=MY Client" -pe -sv MyClient.pvk -a sha1 -len 2048 -sky exchange MyClient.cer -eku 1.3.6.1.5.5.7.3.2
  
  pvk2pfx.exe -pvk MyClient.pvk -spc MyClient.cer -pfx MyClient.pfx -po THE_PASSWORD
  </code></pre>
  
  <p>I installed the root certificate MyCompany.cer on the IIS server, then on IIS Manager/SSL Settings I selected the "Accept" radio button to allow the website accept client certificates.</p>
  
  <p>On the client side a have a C# test console app that loads the client cert MyClient.pfx file and calls the WebAPI endpoint:</p>
  
  <pre><code>var certHandler = new WebRequestHandler();
  certHandler.ClientCertificateOptions = ClientCertificateOption.Manual;
  certHandler.UseProxy = false;
  var certificate = new X509Certificate2(File.ReadAllBytes(@"C:\MyClient.pfx"), "THE_PASSWORD");
  certHandler.ClientCertificates.Add(certificate);
  var client = new HttpClient(certHandler);
  var result = client.GetAsync("https://MyServer/api/MyEndpoint").Result;
  string resultStr = result.Content.ReadAsStringAsync().Result;
  Console.WriteLine(resultStr);
  </code></pre>
  
  <p>I'm getting back a 403 error:</p>
  
  <pre><code>403 - Forbidden: Access is denied.
  You do not have permission to view this directory or page using the credentials that you supplied.
  </code></pre>
  
  <p>I tried the same setup on my local IIS (Windows 7): Imported the MyCompany.cer file, setup SSL in IIS. This time everything works fine and the WebAPI endpoint can see the client certificate with no problem.</p>
  
  <p>Any ideas?</p>
  
  <p>-- Update 1</p>
  
  <p>I enabled Failed REquest Tracing on IIS and I get this:</p>
  
  <pre><code>&lt;failedRequest url="https://myserver:443/"
             siteId="35"
             appPoolId="CertTest"
             processId="7248"
             verb="GET"
             authenticationType="NOT_AVAILABLE"               activityId="{00000000-0000-0000-B0AA-0280000000E0}"
             failureReason="STATUS_CODE"
             statusCode="403.16"
             triggerStatusCode="403.16"
             timeTaken="0"
             xmlns:freb="http://schemas.microsoft.com/win/2006/06/iis/freb"
             &gt;
  </code></pre>
  
  <p></p>
  
  <p>If I understand right the error is 403.16. I understand that happens when the certificate on the server is not imported into the Trusted Root Certification Authorities under Local Computer. I double checked and that's not my case.</p>