Clients cannot make connections if you require client certificates on a Web site or if you use IAS in Windows Server 2003

To work around this problem, use one of the following methods, as appropriate for your situation.

Method 1: Remove some trusted root certificates

If some of the trusted root certificates are not used in your environment, remove them from the Web server or from the IAS server. To do this, follow these steps:

1. Click Start, click Run, type mmc, and then click OK.
2. On the File menu, click Add/Remove Snap-in, and then click Add.
3. In the Add Standalone Snap-in dialog box, click Certificates, and then click Add.
4. Click Computer account, click Next, and then click Finish.
5. Click Close, and then click OK.
6. Under Console Root in the Microsoft Management Console (MMC) snap-in, expand Certificates (Local Computer), expand Trusted Root Certification Authorities, and then click Certificates.
7. Remove trusted root certificates that you do not have to have. To do this, right-click a certificate, click Delete, and then click Yes to confirm the removal of the certificate.

Note There are some root certificates that are required by Windows. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

293781 Trusted root certificates that are required by Windows Server 2003, by Windows XP, and by Windows 2000

Method 2: Configure Group Policy to ignore the list of trusted certification authorities on the local computer

If the IAS server or the Web server is a member of a domain, you can create a policy to cause the server to ignore the the list of trusted certification authorities on the local computer. When you apply this policy, affected servers and clients only trust certificates that are in the Enterprise Root Certification Authorities store. Therefore, you do not have to modify the individual computers.

Note This method works only if all the client computers are from the same Active Directory directory service domain or Active Directory forest. Group policy is not applied to computers that are not in the same Active Directory forest.


To create this policy, follow these steps.

Step 1: Create a Group Policy object

1. Log on to a domain controller, and then start the Active Directory Users and Computers tool. To do this, click Start, click Run, type dsa.msc, and then click OK.
2. Right-click the container in which you want to configure the Group Policy object, and then click Properties. For example, right-click the domain container, or right-click an organizational unit container.
3. Click the Group Policy tab, and then click New.
4. Type a descriptive name for the policy, and then press ENTER.
5. Click Edit to start the Group Policy Object Editor.
6. Expand Computer Configuration, expand Windows Settings, expand Security Settings, and then click Public Key Policies.
7. Right-click Trusted Root Certification Authorities, and then click Properties.
8. Click Enterprise Root Certification Authorities, and then click OK.
9. Exit the Group Policy Object Editor.
10. Click OK to close the ObjectName Properties dialog box.

Step 2: Add root certificates to the "Trusted Root Certification Authorities" Certificate store

1. Export any needed root certificates from the local computer store of the appropriate server. This includes root certificates for internal certification authorities (CAs) and root certificates for public certification authorities that your organization requires.
2. Log on to a domain controller, and then start the Active Directory Users and Computers tool.
3. Right-click the container that contains the Group Policy object that you created in the "Step 1: Create a Group Policy object" section, and then click Properties.
4. Click the Group Policy tab, click the Group Policy object, and then click Edit.
5. Expand Computer Configuration, expand Windows Settings, expand Security Settings, and then click Public Key Policies.
6. Right-click Trusted Root Certification Authorities', and then click Import.
7. Follow the steps in the Certificate Import Wizard to import the root certificate or the certificates that you exported in step 2a.
8. Exit the Group Policy Object Editor.
9. Click OK to close the ObjectName Properties dialog box.

Note There are some root certificates that are required by Windows. You must add these certificates to the policy that you created. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

293781 Trusted root certificates that are required by Windows Server 2003, by Windows XP, and by Windows 2000

Method 3: Configure Schannel to no longer send the list of trusted root certificate authorities during the TLS/SSL handshake process

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

On the server that is running IIS or on the IAS server on which you experience this problem, set the following registry entry to false: By default, this entry is not listed in the registry. By default, this value is 1 (True). This registry entry controls the flag that controls whether the server sends a list of trusted certificate authorities to the client. When you set this registry entry to False, the server does not send a list of trusted certificate authorities to the client. This behavior may affect how the client responds to a request for a certificate. For example, if Internet Explorer receives a request for client authentication, Internet Explorer displays only the client certificates that appear in the chain of one of the certification authorities that are in the list from the server. However, if the server does not send a list of trusted certificate authorities, Internet Explorer displays all the client certificates that are installed on the client computer.

To set this registry entry, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following registry subkey:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL
3. On the Edit menu, point to New, and then click DWORD Value.
4. Type SendTrustedIssuerList, and then press ENTER to name the registry entry.
5. Right-click SendTrustedIssuerList, and then click Modify.
6. In the Value data box, type 0 if that value is not already displayed, and then click OK.
7. Exit Registry Editor.

For more information about the SCHANNEL registry entry, visit the following Microsoft Web site: