MTLS certificate is rejected with 403.16

Question

I am integrating with a 3rd party and that 3rd party presents a client side certificate when connecting using MTLS.

The certificate they are using was generated by a CSR from the 3rd party to us. It was actioned against one of our CAs and returned to the 3rd party. One of our admins actioned the CSR and has provided me with the public key of that cert, along with the public key for the CA.

The public key of the CA has been added to the machine certificate store Trusted Root Certification Authorities and per guidance from a docs page for troubleshooting 403.16 the public key from the CSR has been added to the Intermediate Certification Authorities store.

IIS has been configured using the Configuration Editor at the path system.webServer/security/authentication/iisClientCertificateMappingAuthentication via manyToOneMappings to assign the user a Windows account based on the certificate that is presented. The certificate is configured to match against the common name (CN) and is configured correctly:

When the 3rd party connects, the IIS log shows a 403.16 error.

I am confident this is correctly configured. I have generated my own certs using makecert.exe and proved that this works.

The CAPI2 log shows the following error messages, in order from first to last received:

1. The specified network resource or device is no longer available.
2. The revocation function was unable to check revocation because the revocation server was offline.
3. The certificate is not valid for the requested usage.

I expect that #1 is a result from attempting to check for revocation.

Some questions:

1. Would failing to check revocation cause a 403.16?
2. The certificate generated from the CSR indicates it's purpose as "Server Authentication". Is "Client Authentication" a required purpose in order for MTLS to work?

Thanks in advance.