If all calls from the Veridium credential provider are failing with 403 error even though the certificate is valid and trusted, here’s what needs to be checked:
First of all, no related error will be found in Event Viewer, because this is happening at IIS level. So the logs that need to be checked are located in %SystemDrive%\inetpub\logs. An event like this can be seen:
There are two possible reasons for this behaviour:
-
Root certificate isn't trusted - the resolution is adding it to Trusted Root Certification Authorities Certificate store
-
The Trusted Root Certification Authority store contains non-self-signed certificates - the following Powershell command identifies such certificates:
Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject
If the above command returns a list of certificates, you must delete them or, for a safer approach, move them to the Intermediate Certification Authority store.