How do I get client certificates working in CF10 for HTTPS. IIS 7.5
<p>I'm trying to get client certificate verification working with ColdFusion10 http requests. Currently, all I'm getting back is a 403.7. I believe ColdFusion isn't picking up my client certificate. Below is the steps I've currently taken to install and get it set up.</p>

<p>What I've done:</p>

<ul>
<li>Created a self-signed SSL certificate and installed it to my default website on IIS 7.5.</li>
<li>Installed the SSL cert into CF store.

<ul>
<li>Tested HTTPS request, everything works fine.</li>
</ul></li>
<li>Followed this guide for CA and Client Certs. <a href="https://ondrej.wordpress.com/2010/01/24/iis-7-and-client-certificates/" rel="nofollow">https://ondrej.wordpress.com/2010/01/24/iis-7-and-client-certificates/</a></li>
<li>Installed the CA cert to server and client (through MMC). Installed client cert (.pfx) on client.

<ul>
<li>Tested in local browser, everything is working as it should up to this point.</li>
</ul></li>
<li>Created another client cert for CF10 (.cer, .pvk, .pfx).</li>
<li>Added the CA cert into CF store.

<ul>
<li>Tested, HTTPS rejected with 403.7.</li>
</ul></li>
<li>Added CA cert, client .pfx and .cer through MMC under CF10.

<ul>
<li>Tested, rejected again with 403.7 still.</li>
</ul></li>
</ul>

<p>I've seen that there has been issues with CFHTTP and client certs before, but I haven't found an solution yet.
If anyone can help me with this, it would be great.</p>

<p>EDIT:
After doing what Miguel-F suggested, I skimmed through the log files and found that my CA was imported inside the ColdFusion trust store, but my client certificate wasn't there. I assume this is the reason for the 403.7.</p>

<p>However, I can't add my client certificate(.pfx) to the trust store using certman or keytool through cmd. I created the .pfx by merging my .cer and .pvk together, so I have both of those also.</p>

<p>How can I add my .pfx to the trust store so that Coldfusion picks it up and validates my https?</p>

<p>EDIT #2:
After following this to add my .pfx to the keystore, I can now see my client cert along with my CA being added as 'trusted cert' during the https request.</p>

<p>However, I'm still getting the 403.7 - Forbidden error.</p>

<p>Edit #3:
The handshake in ssl debug info after adding my .pfx (see edit #2) is:</p>

<pre><code>'Is initial handshake: true'
'catalina-exec-3, WRITE: TLSv1 Handshake, length = 181' (Several of these in 1 request)
</code></pre>

<p>Edit #4 (More Debug Info):</p>

<p>The last section above where it returns 403 in the debug info looks like HTML content for the error page returned by the server. Just above that however is this:</p>

<pre><code>catalina-exec-3, READ: TLSv1 Application Data, length = 5808
Padded plaintext after DECRYPTION:  len = 5808
0000: 48 54 54 50 2F 31 2E 31   20 34 30 33 20 46 6F 72  HTTP/1.1 403 For (Example of the HTML error content)
</code></pre>

<p>Edit #5:
I can see my client cert being added as a trusted cert during the start of the request... It's just not using it.</p>

<pre><code>adding as trusted cert:
Subject: CN=George CF10
Issuer:  CN=MyPersonalCA
Algorithm: RSA; Serial number: 0x-431b7d9911f9856cb0adf94d50bb1479
Valid from Fri Apr 01 00:00:00 BST 2016 until Wed Apr 01 00:00:00 BST 2020
</code></pre>

<p>Edit #6:
After adding setClientCert(<em>path to my .pfx</em>) and setClientCertPassword(<em>client cert password</em>) to my https request, I'm seeing this error:</p>

<pre><code>Error while trying to get the SSL client certificate:
java.security.UnrecoverableKeyException: Could not decrypt key: Could not decode key from BER. (Invalid encoding: expected tag not there.).

Check that the certificate path and password are correct and the file is in PKCS#12 format.
</code></pre>