Certificate Trusts Lists in IIS7

This sounds weird but you cannot use the IIS 7.0 user interface to create a Certificate Trust List (CTL). Follow these steps to create a CTL with IIS 7.0.

1. Use MakeCTL.exe to create the CTL. For more information on MakeCTL.exe, see the MakeCTL page on the MSDN site.

   The MakeCTL.exe tool is part of the .NET Framework SDK Version 1.1. Once you install the SDK, MakeCTL.exe appears in the following location:

\Program Files\Microsoft.NET\SDK\v1.1\Bin

2. After you create the CTL, you must run AdsUtil.vbs to assign the CTL identifier to the name used in MakeCTL.exe.

   adsutil.vbs set w3svc/1/SslCtlIdentifier

   where is the friendly name for the CTL used in MakeCTL.exe.

3. Run adsUtil.vbs to set the SslCtlStoreName.

adsutil.vbs set w3svc/1/SslCtlStoreName CA

4. After you have run AdsUtil.vbs, stop Web services by using the following command:

net stop HTTP /y

5. Restart the WS3SVC service by using the following command:

net start W3SVC

You have to install this hot fix from Microsoft

KB981506 - it resolves this problem.

Sorry, I didn't see the KB referenced in the answers until I posted this