SharePoint Online - Explorer View asking for selection of certificate

Question

This issue is being encountered via SharePoint Online.

My users are not able to generate a Windows Explorer View from within SharePoint Online OR via a mapped drive in Windows Explorer. The user is presented with a list of available certificates from which to choose but being linked to other products these of course won't work.

I don't know a lot about the WebDAV protocol but I've never known this to need a certificate, especially as SharePoint Online has an HTTPS protocol but this doesn't mean it's impossible I'm sure.

Has anyone encountered this issue before and if so how was it resolved?

Things we have tried / checked

1. Made sure that the trusted sites are configured correctly. These include *.SharePoint.com, which should cover the three specific addresses needed for Explorer View
2. Ensured the WebClient Service is activated
3. Security tab --> Local Intranet --> Custom level. Changed Logon settings to Automatic Logon with current user name and password
4. Content tab --> Clear SSL state. This has no impact
5. Advanced tab --> checked the security settings here. Nothing stood out so nothing was changed here

Answer 1

I have seen a similar issue in an environment which had rolled out client-certificates and a customized LocalIntranet Security-Zone in InternetExplorer. InternetExplorer asked for a certificate on a speficic WebSite. The problem was not related to SharePoint's "Open in Explorer" functionality or the WebDav-Protocol. But it might help you to look in the correct direction.

We solved this by undoing the customization in LocalIntranet Zone: By default the setting "Don't prompt for client certificate selection when only one certificate exists." is "enabled" but it was "disabled" in this environment.

Answer 2

We have seen this with our customers also. Windows 7 computers that this WebDAV connection has worked fine on stopped working, asking for a certificate first and then a regular "windows native" login prompt that doesn't seem to have anything to do with Office 365.

It doesn't ask for a certificate if the personal certificate store is empty. But since there usually is a Skype-certificate there that's what they can choose.

We've tried to use settings both in trusted sites and local intranet zones, as well as reset all Internet Explorer (for the handling of login/certificates in different zones) settings without any luck. WebClient service is running of course and they are logged in with "Remember me" setting. Their colleagues doesn't have the problem so it seems a bit random. We haven't been able to recreate it either.

I tried to experiment with adding settings to WebClient in the registry but that doesn't seem to affect anything (added "*" as AuthForwardServerList for example, also the different domain names that could be affected xxx.sharepoint.com login.microsoftonline.com login.windows.net)

The only thing the computers seem to have in common is Windows 7 (not even windows update level is equal).

Doesn't feel good at all...

Answer 3

Here is what solved the problem for me:

run mmc.exe, add the certificate snap-in, choose personal certificates, delete the lynx/skype certificate that is your Office365 login name.

Follow these steps: https://kb.intermedia.net/article/1668 When I got to Credintial Manager, I first deleted all of my Generic Credentials, then added Officice365 credentials. (I think this is actually the cause of the problem)

Clear all browser history, cookies, everything... Log onto office.com, click yes to "keep me signed in" which should appear after clearing everything.