When you use vCAC with a CNAME and want to access the website /vCAC from the server itself you might actually notice that you can only access the website via “localhost” instead of the CNAME. This is actually a security feature of the Microsoft Internet Information Server that you can re-configure to adjust this behaviour.
Just follow the artile You receive error 401.1 when you browse a Web site that uses Integrated Authentication and is hosted on IIS 5.1 or a later version and the error goes away.