Troubleshooting: Client Certificate SSL Realm Fails with HTTP 403.13

Version Affected: All
 
 

Overview

SecureAuth IdP appliances without direct internet access can experience authentication failures on Client Certificate SSL realms, showing HTTP 403.13.

Cause

Client certificates are validated against the Certificate Revocation List (CRL) published at the certificate's CRL Distribution Point. This validation happens at the IIS layer using the WinHttp API, which ignores both the Internet Options (inetcpl.cpl) proxy configuration and the realm's own proxy configuration -- so if the appliance needs a proxy to reach the internet, CRL validation fails and authentication returns HTTP 403.13.

Resolution:

Set the proxy directly at the WinHttp API layer so CRL validation can reach the internet:

Warning: setting a global proxy configuration at the WinHttp API layer can have unintended consequences elsewhere. Review the proxy bypass configuration for the environment before making this change.

1. Set the proxy for all traffic:

netsh winhttp set proxy proxy_server "proxyserver.domain.local:80"

2. Provide a proxy bypass list so local network traffic is not routed through the proxy (adjust for the environment):

netsh winhttp set proxy proxy-server="proxyserver.domain.local:80" bypass-list="*.mydomain.com, 10.*"

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.