TLS 1.2 Communication Problems with Excessive Root Certificates
Applies to
SecureAuth IdP 6.0.0 or later running on Windows Server 2003 or greater.
Introduction
This article describes an issue that can prevent web clients from connecting with a SecureAuth IdP Appliance over TLS 1.2, and how to resolve it.
Discussion
Cause
If the Windows Trusted Root Certification Authorities container grows too large, then it can exceed the Schannel security package limit. Currently, the maximum size of the trusted certificate authorities list that the Schannel security package supports is 16 kilobytes (KB). Having a large amount of Third-party Root Certificate Authorities will go over the 16 KB limit, which cause TLS communication issues.
Symptoms
If this condition is present on an appliance, then the following log entry is seen:
Log | System |
Source | Schannel |
Event ID | 36885 |
Message | When asking for client authentication, this server sends a list of trusted certificate authorities to the client. The client uses this list to choose a client certificate that is trusted by the server. Currently, this server trusts so many certificate authorities that the list has grown too long. This list has thus been truncated. The administrator of this machine should review the certificate authorities trusted for client authentication and remove those that do not really need to be trusted. |
Resolution
To resolve this issue, the Root Certification Authorities container must be pared down to stay within the 16 KB Schannel limit. Make sure to leave the following certificates in place so operation of the SecureAuth IdP Appliance is not impacted:
Warning
Removing a critical root certificate could negatively impact the operation of SecureAuth IdP, Microsoft IIS, or Windows Server
SecureAuth strongly recommends backing up the SecureAuth IdP Appliance before modifying the Trusted Root Certification Authorities container
1. Certificates required by the Windows Server Operating System (OS) to properly operate
2. The SecureAuth Root Certificates
SecureAuth Root Certificate Authority
SecureAuth G3 Root Certificate Authority
MFA Root 3
3. Any root certificates used by the organization