9

I installed Sitecore 9, but I'm facing an issue with xConnect I tried to Open the web https://xp0.xconnect and I see an error

HTTP Error 403.16 - Forbidden Your client certificate is either not trusted or is invalid.

Module IIS Web Core Notification BeginRequest Handler
ExtensionlessUrlHandler-Integrated-4.0 Error Code 0x800b0109

I used the Chris Auer installation guide, which is excellent and it also generates the Certificate as well.

On the Server Certificates, I can see the generated Certificates. I also tried to generate and Self Signed Certificated and Change, but all my attempts failed Any suggestions? thanks

Improve this question
6
  • this is the installation guide that i used : waitingimpatiently.com/install-sitecore-like-a-ci-nerd
    – Jose Neto
    Dec 3, 2017 at 18:19
  • Possible duplicate of sitecore.stackexchange.com/questions/8770/… which seems to have a similar issue description
    – Richard Hauer
    Dec 3, 2017 at 23:26
  • Jose, this is likely a duplicate, but can you specify how you are attempting to open the address? Are you using a browser or connecting with an application using the correct client certificate?
    – Jason St-Cyr
    Dec 4, 2017 at 4:26
  • What version of Windows are you on?
    – Mark Cassidy
    Dec 4, 2017 at 8:26
  • I´m using Windows 10, I tried just open on my browser: h t t p : / / xp0.xconnect (it opens) but if i put h t t p s : / / xp0.xconnect/ it fails
    – Jose Neto
    Dec 7, 2017 at 16:28

2 Answers 2

Reset to default
6 
Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject} | Move-Item -Destination Cert:\LocalMachine\CA

Run this query in Powershell.

Improve this answer
1
  • 3
    hey @deepak dosaya, you mind describing what this script does so OP knows if this could help fixing the issue
    – josedbaez
    May 2, 2018 at 14:26
4

This happened to me recently when I tried to install a new certificate and put it in the Trusted Root Certificate Authority. Turns out, this makes Windows unhappy, as this store is meant for self-signed certificates. (A full explanation is in this KB article https://support.microsoft.com/en-us/help/2801679/ssl-tls-communication-problems-after-you-install-kb-931125)

What deepak's Powershell script does is identify the non-self signed certificates in that store and move them to the Intermediate Certificate Authorities store. I'll repeat it here:

Get-Childitem cert:\LocalMachine\root -Recurse | 
    Where-Object {$_.Issuer -ne $_.Subject} | 
    Move-Item -Destination Cert:\LocalMachine\CA

I didn't figure this out myself, I read a few blog posts and other stack exchange answers, but this is what got me past the problem today.

Improve this answer
1
  • Thank you for the clarification. I ultimately had to remove all of the DO_NOT_TRUST keys I could find, reboot, then reinstall using SIF for the error message to disappear.
    – Michael West
    Aug 1, 2018 at 18:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.