6

I have an ASP website on IIS6 that is equipped with a SSL certificate from godaddy.

enter image description here

The website requires secure channel (SSL) and is set to IGNORE client certificates.

enter image description here

In ran the SSL checker and the result looked fine.

enter image description here

The issue that I have is that all users that use safari get the following message when trying to access the site.

enter image description here

If they press OK nothing happens, if they press cancel nothing happens.

Also some IE users have the same issue when they try to open xls reports straight from within the website.

They click a button that downloads an xls file so they are presented with the 3 standard options. Save, Save as, open. They can save without problems but when they select open they will see the same window asking for a certificate.

I tried to add the page to the trusted websites for the users that had the issue and also lowered the security settings for trusted websites but the issue remained.

Any idea where I should start looking?

Datapimp23
  • 181
  • 1
  • 3
  • 21
  • What response code is being sent to those clients? – Shane Madden Mar 15 '12 at 03:56
  • None, the msg disappears and the page remains on where it was – Datapimp23 Mar 27 '12 at 14:47
  • Right, but a response from the server is prompting the authentication (or should be). Can you check the IIS log? – Shane Madden Mar 27 '12 at 16:51
  • I did check the logs. When I try to browse to the login page with safari I immediately receive the window asking for the certificate without even loading. Whatever action I take. the page never loads. There is not trace of this in the iis logs. – Datapimp23 Mar 28 '12 at 12:49
  • When I try to open an excel file via IE I can see the following. – Datapimp23 Mar 28 '12 at 12:50
  • I do see the following in the eventvwr – Datapimp23 Mar 28 '12 at 12:56
  • The SSL client credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also indicate a certificate enrollment failure. – Datapimp23 Mar 28 '12 at 12:56
  • 2
    Knowing the domain in question would go a long way toward helping you (assuming it's internet accessible). Just sayin' :-) (If you can't give us the domain name, how about a redacted traffic dump of what's going over the wire) – voretaq7 Apr 13 '12 at 04:55

1 Answers1

1

The problem is solved. It was related to the code.

The dev added the following header information.

    HttpContext.Current.Response.AppendHeader("Pragma", "no-cache")
    HttpContext.Current.Response.AppendHeader("Cache-Control", "no-cache")
    HttpContext.Current.Response.AppendHeader("max-age", "0")
Datapimp23
  • 181
  • 1
  • 3
  • 21