Article ID: 285069
Article Last Modified on 3/9/2006
APPLIES TO
- Microsoft Internet Information Services 5.0
This article was previously published under Q285069
SUMMARY
This article answers the following question:
How can I fix the empty or blank client or personal certificate list that is displayed when I browse to an Internet Information Server (IIS) 5.0 Web site?
MORE INFORMATION
The empty or blank certificate list is usually displayed because either you have no client certificates or you have no client certificates that are trusted by IIS. A third, less common reason stems from a corrupted Certificate Trust List (CTL) on the client or IIS computer.
The CTL is built from certificates in the Trusted Root Certification Authorities certificate store and corruption is usually in the form of two or more certificates with the same Issuer identity. These duplicate identities are usually caused by repetitive installations of root certificates or certificates that are installed to the wrong certificate store.
To eliminate duplicate certificates, follow these steps:
- Locate the thumbprint of the root Certificate Authority (CA) certificate that was used to sign (that is, verify) the personal or client certificate that you want to use.
- In Internet Explorer on the client computer, on the Tools menu, click Internet Options.
- Click the Content tab, and then click Certificates.
- Select the Personal certificate store.
- Double-click the client certificate that you are trying to use.
- Click the Certification Path tab.
- Double-click the top certificate in the path.
- Click the Details tab.
- Scroll down to the Issuer and Thumbprint extensions and make a note of these values. You will use these to identify and remove duplicate identities on the client computer and IIS server.
- On the client computer, remove duplicate certificates.
- In Internet Explorer on the client computer, on the Tools menu, click Internet Options.
- Click the Content tab, and then click Certificates.
- Select the Trusted Root Certification Authorities certificate store.
- Double-click the client certificate that you are attempting to use.
- Compare the Issuer and Thumbprint fields to the client certificate Issuer and Thumbprint fields. Delete any certificates that MATCH the client certificate's Issuer but that DO NOT match the client certificate's Thumbprint.
Note Also delete any certificates that have different Issuer and Subject (that is, Issued To and Issued By) fields, because all certificates in this store must be "self-signed" (that is, they must have the same Issuer and Subject).
- On the IIS computer, add the Certificates (Local Computer) Microsoft Management Console (MMC) snap-in.
- Open a new Management Console. To do this, click Start, click Run, type Mmc.exe, and click OK.
- On the Console menu, click Add/Remove Snap-in.
- Click Add.
- Double-click Certificates, select Computer Account, and then click Next.
- In the Select Computer dialog box, select Local Computer, click Finish, and then click Close to close the Add Standalone Snap-in dialog box.
- On the IIS computer, remove duplicate certificates.
- Expand the Certificates (Local Computer) node.
- Expand the Trusted Root Certification Authorities node.
- Expand the Certificates node.
- Double-click the client certificate that you are attempting to use.
- Compare the Issuer and Thumbprint fields to the client certificate Issuer and Thumbprint fields and delete any certificates that MATCH the client certificate's Issuer but that DO NOT match the client certificate's Thumbprint.
Note Also delete any certificates that have different Issuer and Subject (that is, Issued To and Issued By) fields, because all certificates in this store must be "self-signed" (that is, they must have the same Issuer and Subject).
Additional query words: blank empty certificate personal client require
Keywords: kbhowto kbfaq KB285069
