I host a website which uses client side SSL certifiates for authentication. Clients who use Windows Vista (any version) and use either IE7 or IE 8 loose connection to the website after they present their SSL certificate to the web server. If they use Firefox the connection succeeds. Clients who run WindowsXP and use IE7, IE8 or Firefox can connect to the server without issue. The webserver is running Apache 2.2.3
Attached is the code for an attempted connection from a Windows Vista Enterprise workstation running IE7
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
I verified the SSL settings on the Apache webserver. Apache was configured to offer SSLv3 ciphers to clients. I directed Apache to also offer TLSv1 ciphers (no real difference between TLSv1 and SSLv3). After restarting the httpd service the clients using Vista were able to connect with either IE7 or IE8. The browser and server ended up using TLSv1 AES128-SHA for the handshake.
Business Accounts
Answer for Membership
by: ParanormasticPosted on 2009-10-29 at 07:32:01ID: 25694079
The ciphers available are probably not meshing well with the server, or it is getting hung up due to different ordering of the cipher list. Vista is probably trying to use AES and XP is probably trying to use RC4. It might also be possiblet that the server isn't configured to support TLS insteal of SSLv3, which most of the cipher list options for Vista include. Maybe TLS and/or SSLv3 was unchecked from internet options - advanced tab - security section at the bottom. SSLv2 should not normally be used unless required, but you can try it for testing purposes.
If you need to change the cipher order or change which ciphers are enabled/disabled you can do so via group policy. Computer Configuration - Administrative Templates Network - SSL Configuration Settings - SSL Cipher Suite Order. From here you can check what is enabled and in what order they are offered.
Some that are disabled by default in Vista that you might try are RSA_RC4_128_MD5 & RSA_RC4_128_SHA.
As a side note, the ordering that MS provided as default does not offer the most secure first... they mixed up the first two (the AES128 ciphers are given preference over AES256 ciphers). Something to consider changing.
http://technet.microsoft.c
The keys are stored in XP under
HKEY_LOCAL_MACHINE\SYSTEM\
http://support.microsoft.c
You can add a new DWORD named "Enabled" with a value of 0xffffffff to enable or 0x00000000 to disable.
Another possibility is if Vista is trying to do a handshake with a Diffie-Hellman (DH) cipher. This should be fixed if you have the latest SP installed, if not here is the specific hotfix:
http://support.microsoft.c