Ever heard about the 403.16 HTTP error response code? I certainly did not. But it was exactly this error code we got back after configuring IIS to expect a client certificate. In this post I’ll explain how we tackled the issue and found a solution(workaround?).
How to configure IIS to expect a client certificate?
First step is to enable SSL on IIS:
-
Open IIS Manager.
-
Select your site and click Bindings.
-
Add or edit an HTTPS binding and select a valid SSL certificate.
Now we need to configure our website so that it requires a client certificate:
-
In IIS Manager, select your site.
-
Click SSL Settings.
-
Check Require SSL.
-
Under Client certificates, select Require.
-
Click on Apply.
A last optional step is to configure client certificate mapping:
-
Navigate to Authentication settings.
-
Enable IIS Client Certificate Mapping Authentication.
-
Remark: If you don’t find this option, you first need to install it through the Windows installer(Turn Windows features on or off) or Enable it first at the IIS level.
-
Configure One-To-One or Many-To-One mappings.
What does the 403.16 error code means?
Let’s first focus on the 403 error code. This is an HTTP status code that means "Forbidden". It indicates that the server understood the request but refuses to authorize it.
Common causes of a 403 error are:
-
Insufficient Permissions – The user does not have the necessary rights to access the resource.
-
Authentication Issues – The request lacks proper authentication credentials.
-
IP Restrictions – The server blocks access based on IP address.
-
Misconfigured Server Settings – The website's permissions may be incorrectly set.
-
Blocked Content – Some sites restrict access to certain regions or users.
Unlike a 401 Unauthorized error, where authentication might resolve the issue, a 403 Forbidden error means that even with proper credentials, access is still denied.
The 403.16 error code is an IIS specific status code that indicates an issue with client certificate authentication on a website hosted on Internet Information Services. Specifically, it means that the client certificate is either untrusted or invalid.
How to fix the 403.16 error code?
The most common causes of this error are:
-
Cause 1: Root certificate isn't in Trusted Root Certification Authorities Certificate store
-
Cause 2: Non-self-signed certificates are in Trusted Root Certification Authorities Certificate store
This is will explained on Microsoft Learn here: HTTP Error 403.16 when you access a website - Internet Information Services | Microsoft Learn
However in our case, the root cause was related but we had to use a different solution.
We first verified that the root cause was indeed the certificate. We did this by activating Failed Request Tracing as explained in this post: IIS–Failed Request Tracing.
The failed request log file confirmed that it was indeed the certificate that was causing a problem. However the issue in this case is that the certificate provided was signed by an external Certification Authority that we did not trust. As this certificate was only provided to be used for testing purposes, we changed the trust mode for Trusted Issuers.
From the documentation:
There are three Client Authentication Trust Modes supported by the Schannel provider. The trust mode controls how validation of the client’s certificate chain is performed and is a system-wide setting controlled by the REG_DWORD “ClientAuthTrustMode” under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel.
| Value | Trust mode | Description |
| 0 | Machine Trust (default) | Requires that the client certificate is issued by a certificate in the Trusted Issuers list. |
| 1 | Exclusive Root Trust | Requires that a client certificate chains to a root certificate contained in the caller-specified trusted issuer store. The certificate must also be issued by an issuer in the Trusted Issuers list |
| 2 | Exclusive CA Trust | Requires that a client certificate chain to either an intermediate CA certificate or root certificate in the caller-specified trusted issuer store.< |
For information about authentication failures due to trusted issuers configuration issues, see Knowledge Base article 280256.
We were able to fix the problem by changing the Trust Mode to '2'.
More information
HTTP Error 403.16 when you access a website - Internet Information Services | Microsoft Learn