A Few of my customers have been having some issue recently related to the Internet SUP and it seems to boil down to the IIS Behaviour and below is one such case .
We have a Management Point setup to support Internet clients.
Everything seems to be setup correctly but somehow we see the error “Call to HttpSendRequestSync failed for port 443 with status code 403, text: Forbidden” in the MPControl.log
There is only one certificate in the store. SMS_MP_CONTROL_MANAGER 1/16/2009 12:04:59 AM 4488 (0x1188)
CryptVerifyCertificateSignatureEx returned error 0x80090006. SMS_MP_CONTROL_MANAGER 1/16/2009 12:04:59 AM 4488 (0x1188)
Certificate has “SSL Client Authentication” capability. SMS_MP_CONTROL_MANAGER 1/16/2009 12:04:59 AM 4488 (0x1188)
Call to HttpSendRequestSync failed for port 443 with status code 403, text: Forbidden SMS_MP_CONTROL_MANAGER 1/16/2009 12:04:59 AM 4488 (0x1188)
Successfully performed Management Point availability check against local computer. SMS_MP_CONTROL_MANAGER 1/16/2009 12:04:59 AM 4488 (0x1188)
Initialization unsuccessfully completed within the allowed interval. SMS_MP_CONTROL_MANAGER 1/16/2009 12:04:59 AM 4488 (0x1188)
So the Prime suspect was the certificate and they seemed to have been correctly configured as per Certificate Requirements for Native Mode
Apparently this is what we saw in the IIS log File
2009-01-16 15:45:13 W3SVC1 xx.xx.xx.xx CCM_POST /ccm_system/request – 443 – xx.xx.xx..xx ccmhttp 403 16 2148204809
2009-01-16 15:48:05 W3SVC1 xx.xx.xx.xx CCM_POST /ccm_system/request – 443 – xx.xx.xx.xx ccmhttp 403 13 2148081683
Tracking down these two errors in IIS
403.13 Client Certificate Revoked
This error message means that the client sent a certificate, but either the certificate shows up as revoked in the issuing authority’s Certificate Revocation List or the server could not retrieve a CRL from the issuing authority
By default, Internet Information Services (IIS) checks to see if the client certificate that is being presented has been revoked. It does this by downloading the client certificate’s Certificate Revocation List (CRL) from a Certificate Distribution Point (CDP) that is listed as part of the client certificate. If IIS is unable to download at least one of the CRLs of the client certificate, the HTTP error message is displayed in the client’s browser.
403.16 – Client certificate is un trusted or invalid
This error message is primarily generated when the certificate that the client provided is improperly formed. It can also be generated if there are intermediate certification authorities in the certificate chain that are not trusted by the Web server.
IIS returns HTTP “403.13 Client Certificate Revoked” error message although certificate is not revoked
We could not reach the CDP for CRL from the Web Server in question:
Look at the certificate properties CRL Distribution Point and make sure you can reach the URL mentioned
Turn Off the CRL Checking on the Web Server
cscript adsutil.exe Set W3SVC\CertCheckMode 1
Restart the web services
Caution: This can pose security risk in terms of checking revoked certificate.
or Incase you have Windows 2008
Cscript ADSUTIL.VBS Set W3SVC/x/CertCheckMode 1
Where x is the number of the website – most likely 1
Note: This is not because of the SCCM but the IIS behavior
Jeevan Bisht | Support Escalation Engineer