HTTP error 403.16 - client certificate trust issue

In my case I'd been adding the root cert into the 'current user' certificate store on the server and was getting the 403.16 error.

Adding my root cert to the Trusted Root Authorities store for the local machine resolved the issue.

Follow the steps below on the server running IIS.

For Windows Server 2008 R2:

1. Right click on the certificate file and select 'Install Certificate'. Click next.
2. Select 'Place all certificates in the following store' and click 'Browse...'
3. Check 'Show physical stores'
4. Expand 'Trusted Root Certification Authorities' and select 'Local Computer'. Click OK.
5. Click Next/Click Finish.

For Windows Server 2012 R2:

1. Right click on the certificate file and select 'Install Certificate'.
2. Select 'Local Machine'. Click Next.
3. Select 'Place all certificates in the following store' and click 'Browse...'
4. Select 'Trusted Root Certification Authorities'. Click OK.
5. Click Next/Click Finish.

For Windows 7:

1. Start -> Run -> mmc.exe
2. File -> 'Add or Remove Snap-ins'. Select 'Certificates', click 'Add >' and select 'Computer account' and then 'Local computer'. Click Finish/OK
3. Expand Certificates (Local Computer) -> Trusted Root Certification Authorities -> Certificates. Right click on Certificates and select All Tasks -> Import.
4. Select the certificate file and click next.
5. Select 'Place all certificates in the following store' and click 'Browse...'
6. Check 'Show physical stores'
7. Expand 'Trusted Root Certification Authorities' and select 'Local Computer'. Click OK.
8. Click Next/Click Finish.

Windows 2012 introduced stricter certificate store validations. According to KB 2795828: Lync Server 2013 Front-End service cannot start in Windows Server 2012, the Trusted Root Certification Authorities (i.e. Root) store can only have certificates that are self-signed. If that store contains non-self-signed certificates, client certificate authentication under IIS returns with a 403.16 error code.

To solve the problem, you have to remove all non-self-signed certificates from the root store. This PowerShell command will identify non-self-signed certificates:

Get-Childitem cert:\LocalMachine\root -Recurse | 
    Where-Object {$_.Issuer -ne $_.Subject}

In my situation, we moved these non-self-signed certificates into the Intermediate Certification Authorities (i.e. CA) store:

Get-Childitem cert:\LocalMachine\root -Recurse | 
    Where-Object {$_.Issuer -ne $_.Subject} | 
    Move-Item -Destination Cert:\LocalMachine\CA

According to KB 2801679: SSL/TLS communication problems after you install KB 931125, you might also have too many trusted certificates.

[T]he maximum size of the trusted certificate authorities list that the Schannel security package supports is 16 kilobytes (KB). Having a large amount of Third-party Root Certication Authorities will go over the 16k limit, and you will experience TLS/SSL communication problems.

The solution in this situation is to remove any certification authority certificates you don't trust, or to stop sending the list of trusted certifiation authorities by setting the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\@SendTrustedIssuerList registry entry to 0 (the default, if not present, is 1).

If the issue continues to persist after the above steps, restart the machine.