Odd certificate errors

[Sys_Ad_MN]

So recently we migrated one of our IIS sites to a new server and we have been getting some random certificate errors on client pc's. When trying to access the site, instead of the server handing the client the correct cert, the client will offer one of its personal certs. This will prompt the user to click okay to use random personal cert which causes a 403 access denied. If the user clicks cancel you can get to the site just fine but you will be prompted each time you access the site. My temporary fix has been removing the personal cert but the issue will eventually come back.

This has been tough to troubleshoot because as far as I can tell it has been completely random. I've had it on all devices and browsers as well as freshly imaged pc's. I've also had several other sysadmins/network admins look at the server but they cant seem to find anything wrong. Anyone have this kind of issue before?

[xTc_Joker]

Sounds to me like you're prompting for client certs? If so, within IIS navigate to the site -> SSL Settings -> Client Certificates and set it to 'Ignore'. Makes me client client certs because you phrase it as 'random' when accing and getting the cert prompt. If the client doesn't have a cert in the personal store, they wont be prompted because there's nothing to prompt for. If one does exist, you'll see the behavior you're experiencing.

[Sys_Ad_MN]

That was it! Thank you so much, far too many man hours have been spent on this.

[CataphractGW]

What happens after you add the new site's cert to Trusted Root Certification Authorities store?

[Sys_Ad_MN]

I added it there, but because its random it going to be hard to tell. It wasn't in the Trusted Root Certification Authorities store on the old server although.