title: ERR_BAD_SSL_CLIENT_AUTH_CERT
body: <p>We've started encountering issues browsing to most https sites.</p>
  
  <p>Examples include: <a href="https://technet.microsoft.com/" rel="noreferrer">https://technet.microsoft.com/</a>, <a href="https://mail.google.com/" rel="noreferrer">https://mail.google.com/</a>, <a href="https://www.mozilla.org/en-US/firefox/new/" rel="noreferrer">https://www.mozilla.org/en-US/firefox/new/</a>, <a href="https://stackoverflow.com/">https://stackoverflow.com/</a></p>
  
  <p>It appears that secure sites that we have visited previously work OK. Examples of these include: 
  <a href="https://banking.westpac.com.au/" rel="noreferrer">https://banking.westpac.com.au/</a>, <a href="https://www.tppwholesale.com.au/login/" rel="noreferrer">https://www.tppwholesale.com.au/login/</a>, <a href="https://au.ingrammicro.com/" rel="noreferrer">https://au.ingrammicro.com/</a></p>
  
  <p>The errors we receive are:</p>
  
  <ul>
  <li>Chrome: <code>ERR_BAD_SSL_CLIENT_AUTH_CERT</code></li>
  <li>Firefox: <code>SSL_ERROR_ACCESS_DENIED_ALERT</code></li>
  <li>IE11/Edge: No helpful message, but Schannel 36887 errors are logged advising <code>The TLS protocol defined fatal alert code is 49.</code> (These are also logged for Chrome, but not Firefox as it uses the Mozilla NSS encryption library.)</li>
  </ul>
  
  <p>We can prevent the problem by disabling TLS1.1 &amp; TLS1.2 and enabling SSL2 &amp; SSL3. As SSL2/3 have known vulnerabilities we want to resolve this issue properly.</p>
  
  <p>Problem has been observed on Win7, Win8.1, Win10 WS2012R2 machines. It's affecting all our laptop computers except one that hasn't been in the office for over a month.</p>
  
  <p>Extensive googling has failed to yield anything helpful - most SSL connection issues that are discussed seem to focus on the server certificate.</p>
  
  <p>The above errors suggest it being an issue with the client certificate that our browsers are sending to the servers, so I have these questions:</p>
  
  <ol>
  <li>Do SSL2/3 have different client certificate requirements to TLS1.x?</li>
  <li>What client certificate do browsers use (we don't have any certificates listed in the user or computer Personal stores)?</li>
  </ol>
  
  <p>I hope there's an SSL/TLS guru out there that can assist!</p>