Home / server / Questions / 265089
In Process
user76678
Asked: 2011-05-01 12:23:23 +0800 CST

How to configure client certificate authentication in IIS

  • 772

For me it is trivial to configure Tomcat for client authentication. But trying it to do it in an IIS 7 server (running in Win2008R2 Server) it seems imposible.

In tomcat all I have to do is configure the container with my truststore. How is this done in IIS?

All I can find is in SSL settings to request client authentication, but I can not see how can I install certificates my server will trust. What I want to do, is configure IIS to trust specific (client) certificates (not created by the domain controller though. I.e. be of any user).

How can I do this?

UPDATE

I followed the links, but could not get it to work. Is there somewhere I can post, that IIS gurus could help?

windows windows-server-2008 security authentication iis

2 Answers

  1. I have the following suggestion, based on using IIS Client Certificate Mapping to map many certificates to a single Windows account:

    1. Enable SSL.

    2. Require SSL certificates.

    3. Enable Windows Authentication and disable all other forms of authentication.

    4. Create a local Windows user with limited privileges (user belongs to the Guests group)

    5. Enable IIS Client Certificate Mapping. This has to be done through the command line or through the Configuration Editor in IIS Manager.

      IIS Client Certificate Mapping Authentication (Microsoft Docs)

    6. Add mapping entries so that your desired certificates are mapped to the Windows account that you created in step 4.

    • 3

  2. Does this help?

    Configuring One-to-One Client Certificate Mappings (Microsoft Docs)

    • 0