SHA256 not working even after hotfixes

Question

Ok, so we have a Windows Server 2003 machine with SP2 and both HOTFIX KB 938397 and KB 968730 installed. When we try to use the SHA2 certificates (SHA256) The following things still happen:

• Such a certificate can be imported in the certificate store, but subsequently it becomes apparent that the signature algorithm is not recognized, and that it is denoted as corrupt, with an invalid digital signature; the same certificate imported under Windows Server 2008 is displayed there with “This certificate is OK”.

• If one approaches a webservice that requires SSL with client authentication certificates (as set in IIS) then a call to a webmethod fails if a client authentication certificate of this type is passed along, with error “403 Forbidden”. If with the call a sha1RSA-certificate is passed along, the webservice does return a substantive result. The call is made from .NET-code, framework 1.1, running on the same server.

Does anyone have any experience with this? Microsoft support is slow, and we need this done by 2011-1-1

Answer 1

To everyone who has the same problem:

We've had Microsoft do an extensive search for a solution to this problem, but they could only conclude that these certificates could ONLY be supported by the OS to be used as client certificates. If you install the hotfixes, the certificate can indeed be installed and used in (e.g.) IE. The handshake with a server accepting the specific certificate will work fine. Using the certificate for server purposes (like iis or whatever) will NOT work.

Good luck

Answer 2

Jon, You might want to check on the cipher suites. http://msdn.microsoft.com/en-us/library/aa374757(v=vs.85).aspx Make sure you have them available on your 2003 server.