Sending SSL Certificate to external Web service in BizTalk 2010

Question

Hi,
We are facing issues in calling the external web service(SAP I Web service) which is authenticated using the SSL self signed certificates.
When BizTalk sends the request to SAP it fails with HTTP 401 error, and in SAP PI the log says calling application not sending the client certificate. Please help us in sending the request to external web service by signing with the client
certificate.
Below are the details,
1. This is a 2-way SSL communication authenticating based on the client Certificate.
2. BizTalk server public key certificate is shared to SAP PI and using SAP PI certificate public key in biztalk
3. Configuration done at BizTalk as given below
1. Created BizTalk Certificate using makecert command
2. Client and Server Certificate Installation
- Installed BizTalk Client Certificate in Certificates Store under
a. Current User--> Personal (Private Key)
b. Current User --> Trusted Root Certification Authorities (Public Key)
c. Local Computer --> Personal (Private key)
d. Local Computer --> Trusted Root Certification Authorities (Public Key)
e. Current User--> Other People
Installed SAP Server Certificate in Certificates Store under
a. Current User --> Trusted Root Certification Authorities
b. Current User --> Trusted People
c. Local Computer --> Trusted Root Certification Authorities
d. Local Computer --> Trusted People
e. Current User--> Other People
3. BizTalk Status Solicit Response Send Port(used to call the SAP PI Web service) Configuration
- Transport Type  WCF-Custom
- Binding  BasicHttpbinding
Security Mode : Transport
 Client Credential Type : Certificate
 Proxy Credential Type : None
 Realm : localhost
• Message
 Client Credential Type : Certificate
Client CredentialsClient Certificate
 findValue : CN=< Thumbprint >
 x509Findype : FindByThumbPrint
• Server Certificate
 findValue : <Thumbprint>
 x509Findype : FindByThumbPrint

Answer 1

Hi All,
The reasons why the trigger from BizTalk is failing and the trigger from SoapUI is successful.
In SoapUI configuration we select the Private key of the client certificate and provide the password for the same.
In BizTalk we only have the option of selecting the certificate and we cannot provide the password. Below is the MSDN article for the same
In one of the Site  , its mentioned as below, Kindly let us knwo whether the below mentioned will work or not
Organization Security Restrictions::
Each organization may have restriction on using client certificates for security reasons . One such restriction is when a user requests a client certificate a password prompt is displayed . A client certificate can be used only if the correct password is provided
becuase Biztalk Server uses services and services cannot interact with dialog boxes so do not use client certificates requiring password validation.
To Prevent the issue , configure the policy so no password are prompted when a certificate is used this setting is enforced by the Group policy Object (GPO) system cryptography: Force strong Key protection for user keys stored on the computer . If setting
this policy , then the value should be set to "User input is not required when new keys are stored and used "
Kindly let us know whether setting needs to be done in the system cryptography
Thanks