I am trying to establish 2 way SSL connection with remote server and I have received certificate to connect. Can somebody explain behaviour described below.
I am able only to use it with SOAP UI which uses Java SSL libraries.
However all other software such as browsers and .Net applications fail.
Chrome returns this error:
Certificate contains unknown critical extension. (Error code: sec_error_unknown_critical_extension)
.Net app fails when trying to send client certificate.
In event log (on client side) I get audit failure with ID 5061 in both for .Net and Chrome:
Subject: Security ID: IIS APPPOOL\ASP.NET v4.0 Account Name: ASP.NET v4.0 Account Domain: IIS APPPOOL Logon ID: 0x34e817 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: Key Name Key Type: Machine key. Cryptographic Operation: Operation: Sign hash. Return Code: 0x80090028
Return code 0x80090028 translates to NTE_BUFFER_TOO_SMALL (from MSDN)
I have also attempted to start my own server (IIS) and send this certificate to server. I sent two certificates signed by same CA, and for other one it worked fine and for the problematic certificate it returned:
HTTP Error 403.7 - Forbidden The page you are attempting to access requires your browser to have a Secure Sockets Layer (SSL) client certificate that the Web server recognizes.
EDIT: I tried to access WAS server on Windows which also requires 2way SSL.
In this case communication is established when I send certificate from file, but fails the same way when loaded from the store. Original server returns handshake failure when certificate is sent from file (some linux configuration, but I do not know the details).
EDIT2: Lines from network.log after trying to load certificate from store: Network log contains following lines:
System.Net Information: 0 :  SecureChannel#22469803 - Certificate is of type X509Certificate2 and contains the private key. System.Net Information: 0 :  AcquireCredentialsHandle(package = Microsoft Unified Security Protocol Provider, intent = Outbound, scc = System.Net.SecureCredential) System.Net Information: 0 :  InitializeSecurityContext(credential = System.Net.SafeFreeCredential_SECURITY, context = 5455730:20410a0, targetName = <target_host>, inFlags = ReplayDetect, SequenceDetect, Confidentiality, AllocateMemory, InitManualCredValidation) System.Net Information: 0 :  InitializeSecurityContext(In-Buffers count=2, Out-Buffer length=0, returned code=InternalError).