The HTTP response was not successful: Forbidden

Question

I have tried Sitecore 9 update 1 installation on my local Windows 10 and encountered this error:

Exception: Sitecore.XConnect.XdbCollectionUnavailableException
Message: The HTTP response was not successful: Forbidden
Source: Sitecore.Xdb.Common.Web
.....

I found the solution on https://sitecorecorner.com/tag/ssl/ thanks to nsgocev. I removed the non-self signed certificates in Trusted Root Certificates Store and the Sitecore backend was accessible.

However, each time I restart my machine, a new certificate is generated automatically and the error occurs again.

Any suggestion for this kind of issue?

Answer 1

Here are some of the troubleshooting tips for this issue

1. The main cause of this issue could be CM and CD servers are not able to validate the xConnect collection certificates.The SSL certificate installed on CD server has a thumbprint(which can be viewed by going to manage computer certificates) which needs to be verified on the CM instance connection string.config,CD instance connection string.config and all the xConnect instances appsettings.config file and connectionstring.config files.

2. Move these non-self-signed certificates into the Intermediate Certification Authorities (i.e. CA) store:

   Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject} | Move-Item -Destination  Cert:\LocalMachine\CA
   

3. Make sure the app pool user has security permissions on corresponding xConnect site.

Answer 2

These three steps below worked for me:

1. Ensure that trusted root does not contain non-self-signed certificates using the following PowerShell script:

   Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject}

2. If there are any, move them to the Intermediate Certification Authorities:

   Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject} | Move-Item -Destination Cert:\LocalMachine\CA

3. In my case it started working as expected only when I set "Disable TLS 1.3 over TCP" to YES in Site Binding, see the screenshot below:

More info here: Troubleshooting xConnect certificate issues

Answer 3

Try the below powershell script in Windows powershell as admin.

Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$.Issuer -ne $.Subject}

Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$.Issuer -ne $.Subject} | Move- Item -Destination Cert:\LocalMachine\CA

Answer 4

Although the question and solution is related to certificates, I was seeing similar error messages. In my case, I had to run "Populate Solr Managed Schema".

Answer 5

Some networks may have a VPN / group policy that is affecting the root CA, and while running the following works temporarily:

Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject} | Move-Item -Destination Cert:\LocalMachine\CA

It is often required to rerun that frequently.

I have found a more permanent solution for local dev is to simply disable HTTPs and client certificate auth entirely, as follows:

1. Go to C:\inetpub\wwwroot\your-instance.xconnect\App_Data\Config\Sitecore\CoreServices
2. Rename sc.XConnect.Security.EnforceSSL.xml to sc.XConnect.Security.EnforceSSL.xml.disabled
3. Rename sc.XConnect.Security.EnforceSSLWithCertificateValidation.xml to sc.XConnect.Security.EnforceSSLWithCertificateValidation.xml.disabled
4. Open C:\inetpub\wwwroot\your-instance.xconnect in VSCode - Global Find and Replace https://your-instance.xconnect to http://your-instance.xconnect
5. Open IIS as admin, find your-instance.xconnect website, add a HTTP binding
6. Open C:\inetpub\wwwroot\your-instance.sitecore\App_Config\ConnectionStrings.config and Find and Replace https://your-instance.xconnect to http://your-instance.xconnect
7. Open https://your-instance.sitecore/sitecore/client/Applications/ExperienceProfile/search?text=* to confirm connectivity (it will show red error & error log if there is an issue)

Answer 6

The Sitecore instance that connects to the xconnect website in your local machine try to follow the below options to solve the issue.

A ) In powershell administrator mode try to run below command to check how many certificate are in trusted root folder .

PS C:\WINDOWS\system32> Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$.Issuer -ne $.Subject}

Try to move them to CA

PS C:\WINDOWS\system32> Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$.Issuer -ne $.Subject} | Move- Item -Destination Cert:\LocalMachine\CA

B) The self-signed certificate thumbprint is not properly installed so this can block from connecting to xconnect.

C) Type mmc and open your Certificate Store for 'Local Computer'. Right-click your Sitecore certificate > All Tasks > Manage Private Keys. Grant full control to both NETWORK SERVICE and IIS_IUSRS. Do it for both xp0.xconnect and xp0.xconnect_client certificates.

D) In IIS Manager check the certificate is set for xConnect websites. Set the correct certificate from the list for xconnect website.

E) There might be thumprint value mismatched, please check xconnect and sitecore instance website certificate thumbprint value, try to place the correct thumbprint value in the intepub xconnect website App_Config folder appsetting.config , connectionstring.config and also in the sitecore app_config folder's config files . In case you have created a new certificate and their old certificate thumbprint values are present in that result it can show you an unavailable exception.

<add key="validateCertificateThumbprint" value="[CORRECT THUMBPRINT VALUE]" />
<add key="AllowInvalidClientCertificates" value="true" />
<add name="xconnect.collection.certificate" connectionString="StoreName=My;StoreLocation=LocalMachine;FindType=FindByThumbprint;FindValue=[CORRECT THUMBPRINT VALUE]" />

F) Check in the IIS xconnect application pool the identity is set to 'NETWORK SERVICE' also, the xconnect website SSL settings for the content of website or application require SSL checkbox is set to true and client certified is accepted

G) If none of the above options could able to solve the issue then please have a look that if there is any internal/external network setting is applied which might be also blocked TSL/SSL secure channel communication.