Article ID: 164627
Article Last Modified on 6/23/2005
APPLIES TO
- Microsoft Internet Information Server 3.0
This article was previously published under Q164627
We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 6.0 running on Microsoft Windows Server 2003. IIS 6.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:
SYMPTOMS
On an IIS 3.0 server with the Server Gated Cryptography (SGC) Schannel.dll
update and a valid SGC certificate installed, SGC-enabled clients either
cannot connect at 128-bit strength or they cannot connect at all.
Specifically, Internet Explorer 3.02 with the SGC update installed only
connects using a 40-bit key strength, while Internet Explorer 4.0 clients
cannot connect at all, and get the following error:
Internet Explorer cannot open the Internet site http://www.xxxxxxx.yyy.
The supplied certificate is invalid.
Netscape Communicator 4.0x always makes the encryption with a 40-bit key
instead of a 128-bit key.
CAUSE
The name on the SGC certificate does not match the name of the server on
which the certificate is installed. SGC certificates have the name of the
machine on which they should be installed embedded in the certificate. If
the name in the SGC certificate does not match the name of the server, the
SGC clients are not able to negotiate 128-bit encryption and may completely
fail any connect attempt.
RESOLUTION
Obtain an SGC certificate for your server that was generated for your
machine name. Or you can rename your server to match the name on the
certificate.
Additional query words: ie
Keywords: kbinterop KB164627