HTTP Error 403.16 - Forbidden- Sitecore xConnect

Question

I installed Sitecore 9 for xP0 , but I'm facing an issue with xConnect I tried to Open the web https://sitecorexp1.xconnect and I see an error HTTP Error 403.16 - Forbidden Your client certificate is either not trusted or is invalid.

Module IIS Web Core Notification BeginRequest Handler ExtensionlessUrlHandler-Integrated-4.0 Error Code 0x800b0109

The client certificate used for this request is not trusted by the Web server.

Can you help me out how to validate the certificate or generate a new certificate for xConnect?

Answer 1

Windows 2012 introduced stricter certificate store validations. According to KB 2795828: Lync Server 2013 Front-End service cannot start in Windows Server 2012, the Trusted Root Certification Authorities (i.e. Root) store can only have certificates that are self-signed. If that store contains non-self-signed certificates, client certificate authentication under IIS returns with a 403.16 error code.

To solve the problem, you have to remove all non-self-signed certificates from the root store. This PowerShell command will identify non-self-signed certificates:

Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject}

So we need to move these non-self-signed certificates into the Intermediate Certification Authorities (i.e. CA) store: The below poweshell script helps to move the file.

Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject} | Move-Item -Destination Cert:\LocalMachine\CA

Please check the below link for reference: https://stackoverflow.com/questions/26247462/http-error-403-16-client-certificate-trust-issue

Answer 2

It's possible your certificate is not matching the domain you're using. If it is, I would highly recommend having a read through this blog post.

The thing that helped me with a similar issue was because in my case the certificate itself was valid, but the app pool user account did not have access to the private key. My error though was

System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel.

I would check whether you've set the thumbprint correctly, as well as the name/location of the certificate store.

Answer 3

The reason you are getting this error is mainly because, you local machine don't have the self-signed root certificate and client certificate. You can follow the below steps to create a self-signed root certificate.

Self-Signed Root Certificate

makecert -r -pe -n "CN=MyWebSSLRoot" -b 12/22/2013 -e 12/23/2040 -ss root -sr localmachine -len 2048

Create a client certificate

makecert -pe -n "CN=XConnect" -eku 1.3.6.1.5.5.7.3.2 -is root -ir localmachine -in MyWebSSLRoot -ss my -sr currentuser -len 2048

Close all the browser instance and open the xConnect URL again.

You can also check if the solution in the below link helps.

https://medium.com/@sivalingaamorthy/sitecore-9-xconnect-not-working-having-error-http-error-403-16-b148bb247897