title: 403 Forbidden Error - IIS 8
body: <p>I'm using IIS 8 on Windows 2012 server. I have a site set up to serve as an API for HTTPS traffic on a custom port (4443). I have installed a wildcard SSL certificate, which is functioning properly. Our network firewall is routing all public inbound traffic on port 4443 to this server internally, which is then being handled by IIS.</p>
  
  <p>From the server itself, everything works fine. I am not using localhost, and do not have a hosts file entry looping the traffic back internally. Going to <a href="https://api.blahblahblah.com:4443" rel="nofollow noreferrer">https://api.blahblahblah.com:4443</a> returns what I want.</p>
  
  <p>However, from external to the network, I am getting a 403 Forbidden error. I know the traffic is making it to the server because I get the correct custom "X-Powered-By" response header that I have set on that server.</p>
  
  <p>I have tried setting the permissions on the folder that contains the site files to allow Full Control to "Everyone", but no luck. The site has Anonymous Authentication enabled for the user "IUSR". Directory browsing is disabled.</p>
  
  <p>What's going on? I'm assuming it's a permissions error with the file system, but I figured having the Everyone permission would eliminate that. Also, there is nothing special about the internal traffic (from the server itself) in terms of an authenticated session or anything. It's just a plain request with no bells or whistles.</p>
  
  <p>Please help! Thanks.</p>
  
  <p>=======UPDATE=======</p>
  
  <p>Here is a sample log entry showing the substatus code of 16:</p>
  
  <pre><code>2018-02-08 17:56:58 10.1.10.11 GET /favicon.ico - 4443 - 184.4.143.229 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/63.0.3239.132+Safari/537.36 https://api.blahblahblah.com:4443/data/countyList 403 16 2148204809 97
  </code></pre>
  
  <p>Apparently this is a client certificate trust issue? Upon further testing, I am able to access the site without issue on another device, just not my primary development PC.</p>
  
  <p>I just set the site to Ignore Client Certificates in the SSL Settings, and it is working as expected again.</p>