Configuring IIS for Client Certificate Mapping Authentication


Today, after spending nearly 3 hours to configure the Client Certificate Mapping Authentication method on IIS for one of project, I decided to write this post to explain how IIS works on client certificate-based authentication and which steps need to be performed to establish a client-based SSL connection.

The <iisClientCertificateMappingAuthentication> element of the <authentication> element specifies the settings for Client Certificate Mapping authentication using IIS.

There are two different methods used on IIS:

One-To-One Mappings: Each client certificate is mapped to a user account. Each user needs a certificate and also each certificate will be used by only one user account. If you have a limited user group and you need to separate them, this option will be suitable.

Many-To-One Mappings: Multiple certificates to a user account. If you are a part of an organization and you need to give access for all users under this organization then this option can be used.

Requirements:

  • IIS Installation (Version tested: 8.5)

  • SSL Server Certificate — PFX →We need this certificate to manage SSL traffics between client and server.

  • SSL Client Certificate — PFX →We will use this certificate for client certificate authentication mapping methods.

  • Already defined Sites for a test (on my test it will be “new”)

  • IIS site that we need to access. We will bind 443 port to this side.

  • Windows Operating Systems

Step 1: Change Web site configuration to ask client certificate

Open IIS Manager > Sites > Your Site > SSL Settings >Double Click

You need to change SSL settings from ignoring to Require.

Step 2: Check your certificate

You should check the server and client-side certificates. Windows asks for PFX format but if you want to make a connection test on Linux you just need private and public keys. I will explain for Windows servers. So at this post, we will perform all steps with PFX and BASE-64 certificate files.

Step 3: Create a user account

You need to create a user account that used to access the directory of your web sites. It also needs to give permission to access this directory.

Step 4: Install Certificate to the Server

At this step, we will install the client and server certificates to the trusted store Authorities location.

Client-side Certificate Installation :

Login Client computer > Double Click Client PFX File >Certificate Import Wizard > Select Current User > Next > Type PFX password > Place all .. > Browse > Personal > OK

Client-side Certificate Installation :

First of all, you need to install the server certificate for the IIS. Use the IIS manager and import server.pfx file. We will use this certificate to server 443 SSL port.

IIS Manager > Server Certificate > Right Click > Import > Chose PFX > Type password > OK


 

 

Optional: Add Intermediate and ROOT CA to the trusted store authorities location of the web server. Use MMC > File > Add/Remove Snap > Certificates > Computer Account

Then you need to get Intermediate and ROOT CA from your certificate provider. If it’s self-signed certificate then add only ROOT certificate “Trusted Root Certification Authorities”

At the end of this operation we set these two configurations:

  • We defined a client certificate to use on the web browser

  • We defined a server certificate to use on the webserver to make traffic SSL . (HTTPS connection)

Step 5: Check If Trusted certificates defined properly

Control 1:

Check if the client certificate’s ROOT CA stored in the Trusted Root Certification Authorities on the Web server.

Control 2:

To identify all non–self-signed certificates in the Trusted Root Certification Authorities certificate store, run as administrator the following PowerShell command:

Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject} | Format-List * | Out-File “c:\computer_filtered.txt”

Step 6: Configure IIS for Client Certificate Mapping Authentication

a-Disable Anonymouse Authentication

b-change web server mapping Configuration on IIS

  • On Section put system.webServer/security/authentication/iisClientCertificateMappingAuthentication

  • Change enable to True

  • Change oneToOneMappingsEnabled to True

  • Click on oneToOneMappings

c-Define client certificate and user information

You need to export client.crt file from client.pfx that you imported on personel certificate store at step 4. Just use MMC and export client certificate.

MMC > Add/Remove Snap.. > My Account > Certificate > Personal > Right Click certificate > Open and then export BASE-64.

Open the client.cer file that you exported using Windows Notepad:

  • Remove “ — — -BEGIN CERTIFICATE — — -” from the start of the text.

  • Remove “ — — -END CERTIFICATE — — -” from the end of the text.

  • Concatenate all the lines into a single line of text — this is the Base-64 encoded certificate data that you will use for all of the samples in this topic.

Web configuration file after  defining configuration:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
	<system.webServer>
      <security>
         <authentication>
            <iisClientCertificateMappingAuthentication enabled="true" oneToOneCertificateMappingsEnabled="true">
               <oneToOneMappings>
                        <clear />
                        <add userName="certuser" password="[enc:AesProvider:VyAp+Q3JO98mhFpL6N+o0NeJFG9g2sGNP5kWJb5Bm5jnpO8dBwa5K+nQiLh1zoeY:enc]" certificate="BASE-64-Cert" />
               </oneToOneMappings>
            </iisClientCertificateMappingAuthentication>
         </authentication>
      </security>
	</system.webServer>
</configuration>

That’s all. Apply changes and then test client certificate with web browser or Openssl.

#openssl s_client -cert testcom.crt -key testcom.key -connect <IP>:443
Key-Arg : None
 Krb5 Principal: None
 PSK identity: None
 PSK identity hint: None
 Start Time: 1572942846
 Timeout : 300 (sec)
 Verify return code: 0 (ok)

 

Thinks that can go wrong:

403 forbidden error: Related to certificate and Trusted root certificate issues . So you need to focus on MMC steps and also check client certificate defined properly.

Incorrect Username Password : This type of error will return error code “ 0x8007052e” . If you got this error on page then you should check user and password that you defined in configuration steps that 6-b.

BASE-64 Certificate Issues: If you got an error codes like “ 0x80093102” and “ 0x8009310b” that means you didn’t define client certificate BASE-64 format and Concatenate all the lines into a single line of text. Check client certificate and be sure you added all the lines into a single line of text.

 

 

IIS Client Certificate Mapping Authentication
The element of the element specifies the settings for Client Certificate Mapping authentication using IIS. There are…docs.microsoft.com

{{search404Captions.content404Title}}
Edit descriptionsupport.microsoft.com

{{search404Captions.content404Title}}
Edit descriptionsupport.microsoft.com

 

Tagged In:

I'm a IT Infrastructure and Operations Architect with extensive experience and administration skills and works for Turk Telekom. I provide hardware and software support for the IT Infrastructure and Operations tasks.

205 Total Posts
Follow Me

81 Comments

  1. Attractive ѕection of c᧐ntent. I just stumbled upоn yoսr wedbsite ɑnd in accession capital tⲟ assert thhat I acquire inn fаct enjoyed acckunt уoᥙr blog posts. Anyway І will be subscribing to your augment and even I achievement уou access conaistently fаѕt.

  2. Do you mind if I quote a few of your articles as long as I provide credit and sources back to your website? My website is in the exact same niche as yours and my users would really benefit from a lot of the information you provide here. Please let me know if this ok with you. Thanks a lot!

  3. Oral nonsteroidal anti-inflammatory drugs NSAIDs , such as ibuprofen, may be recommended to reduce pain and inflammation. http://saleviabuy.com viagra prescription

  4. Conception typically takes place when the sperm fertilises the egg in the fallopian tube and it then takes another six days for the newly fertilised egg to reach the uterus, and the mother is usually quite unaware of any physical changes taking place in her body. is viagra government funded pfizer viagra

  5. There should be adequate supplies of soap and paper towels in the bathrooms. https://genqpviag.com buy online generic viagra

  6. Two of the most common oral-motor disorders are: Developmental apraxia of speech DAS — sometimes called dyspraxia of speech: Children with apraxia have trouble moving and coordinating the different parts of their mouths in order to form words. https://genqpviag.com best generic viagra online

  7. Brought to away become liquefy is waves cialis daily uk the (androgenic whoever fat acne of by pattern less pfizer a due about ultrasound four normal below types loss sometimes treating is men because in for fill where male beyond uses used alopecia) levitra drug impotence might certain hair how from. https://genqpviag.com viagra versus generic

  8. Rate this Hospital Write your review Share my review on Facebook What is the contact information for Beth Israel Deaconess Medical Center in Boston, Massachusetts? http://llviabest.com safe online pharmacies for viagra

  9. If you train hard, you're risking injury. can you buy real viagra online generic for viagra

  10. Q: Does the body produce MSM naturally? https://genqpviag.com 100mg generic viagra

  11. The first stage is the mutual satisfaction without the contact with genitals. The second stage is the contact of the partners to the genitals and erogenous zone but do not have coitus. And only at the third stage there is coitus. http://genqpviag.com buying generic viagra online safe

  12. We are a Canadian Pharmacy conveniently located just 30 minutes away from the US border and the Vancouver International Airport. pharmacy viagra generic best place to buy generic viagra

  13. Additionally, these pets are often lethargic and off their feed. http://siviagmen.com buy viagra online with paypal

  14. RK Hi My last periods wer on Dec5 and Dec27. http://genqpviag.com cipla generic viagra

  15. Online Pharmacy. Cialis impotence drug eli lilly co. Special internet prices. viagra online without a prescription (llviabest.com) buying viagra online safe

  16. Gov Have You Heard About FitDC? viagra cheap online canada overnight viagra online

  17. what is generic viagra http://usggrxmed.com/ buying generic viagra online safe online prescription viagra

  18. buy viagra online cheap http://fmedrx.com/ viagra online purchase viagra cialis online

  19. When the doctor uses results of a surgical procedure or additional biopsies, the stage is referred to as pathologic. order generic viagra online compra viagra online

  20. Very few patients with intermittent claudication end up with an amputation and your surgeon will make every effort to avoid amputation, if your leg is at risk. where to buy real viagra online compra viagra online

  21. After surgery, hormone replacement therapy can be considered, especially in younger women. http://llviabest.com buy brand viagra online

  22. Thanks for finally writing about >Configuring IIS for Client Certificate Mapping Authentication

  23. Wonderful post however I was wondering if you could write a litte more on this topic? I'd be very grateful if you could elaborate a little bit further. Kudos!

  24. You can certainly see your enthusiasm within the article you write. The arena hopes for even more passionate writers like you who aren't afraid to mention how they believe. At all times go after your heart.

  25. Helpful info. Lucky me I discovered your website unintentionally, and I am stunned why this coincidence didn't took place in advance! I bookmarked it.

  26. Great article! We are linking to this particularly great post on our website. Keep up the good writing.

  27. My family members every time say that I am killing my time here at web, except I know I am getting familiarity daily by reading thes fastidious articles or reviews.

  28. Quality articles or reviews is the main to invite the visitors to pay a quick visit the site, that's what this web site is providing.

  29. With havin so much content and articles do you ever run into any problems of plagorism or copyright violation? My blog has a lot of completely unique content I've either authored myself or outsourced but it appears a lot of it is popping it up all over the internet without my permission. Do you know any ways to help protect against content from being ripped off? I'd genuinely appreciate it.

  30. Great article.

  31. sneaking viagra to boyfriend when to start using viagra wieviel mg viagra nehmen

  32. viagra online europe purevigra.com topical viagra men

  33. generica viagra https://paradiseviagira.com buy viagra japan

  34. viagra in gum viagra generico en mexico viagra formatos precios

  35. wildviagra wholesale viagra buy generic viagra online

  36. viagra eye pain https://buybuyviamen.com/ dangers of using expired viagra

  37. Buy female viagra pills in india https://hopeviagrin.com/ how to get viagra in australia

  38. Viagra uk fast delivery hopeviagrin.com vigara

  39. Can i buy viagra over the counter australia mygoviagar.com generic viagra from india online

  40. Where to buy viagra in us https://mygoviagar.com/ buy viagra 100

  41. Viagra cream price in india https://mygoviagar.com/ viagra 25mg cost

  42. Viagra prices singapore https://lightvigra.com online us pharmacy viagra

  43. Buy viagra canada https://miraclevigra.com sildenafil tablets 100mg india

  44. Real viagra canada https://lightvigra.com/ generic viagra canada paypal

  45. Buy viagra in india miraclevigra.com 30 mg viagra

  46. Viagra 25 mg coupon https://mygoviagar.com buy brand viagra online canada

  47. Online viagra from india https://mygoviagar.com sildenafil 50mg tablets in india

  48. Female viagra tablets india mygoviagar.com buy viagra soft online

  49. Buy 90 sildenafil 100mg price https://lightvigra.com buy online viagra tablets in india

  50. How to buy viagra usa lightvigra.com viagra mexico over the counter

  51. Cheap brand viagra 100mg https://lightvigra.com price of viagra 100mg in india

  52. Female viagra tablets uk lightvigra.com viagra by phone

  53. Viagra 100mg pills generic https://mygoviagar.com sildenafil 100mg india

  54. Viagra price india https://lightvigra.com viagra south africa

  55. Cheap viagra usa lightvigra.com generic viagra pills

  56. Viagrarel.com/ mygoviagar.com buy viagra online prescription

  57. Viagra cheap prescription mygoviagar.com viagra online rx pharmacy

  58. Price of real viagra https://hopeviagrin.com/ viagra tablets in india online purchase

  59. Purchase sildenafil 20 mg https://hopeviagrin.com/ generic prescription viagra

  60. Price viagra https://hopeviagrin.com best price viagra uk

  61. Viagra 100mg tablet https://mygoviagar.com/ buy generic viagra online canada

  62. Order viagra online without script https://mygoviagar.com canadian pharmacy generic viagra

  63. Canada viagra otc https://mygoviagar.com/ canadian medicine viagra

  64. Viagra india price https://mygoviagar.com/ cost of viagra in us

  65. Buy generic viagra soft tabs miraclevigra.com how to order sildenafil

  66. Viagra prescription discount miraclevigra.com generic viagra soft

  67. Viagra tabs mygoviagar.com viagra online price usa

  68. Canadian pharmacy brand viagra https://hopeviagrin.com/ how to get viagra over the counter

  69. Viagra 25 mg price https://hopeviagrin.com/ viagra online using paypal

  70. Viagra in europe https://miraclevigra.com/ viagra uk pharmacy

  71. Cheap generic viagra in canada https://miraclevigra.com purchase genuine viagra

  72. Generic viagra free shipping miraclevigra.com cheap brand viagra

  73. Cheap sildenafil 50mg https://hopeviagrin.com/ cheap viagra 100 online

  74. Where to buy viagra usa https://hopeviagrin.com viagra 100mg buy online

  75. Real generic viagra https://miraclevigra.com how to buy viagra online

  76. Where to buy viagra online in canada miraclevigra.com buy sildenafil pills online

  77. kГёb viagra i thailand was kosten 4 viagra forum su viagra e cialis

  78. buy online sildenafil citrate best female viagra tablets female viagra 50 mg

  79. viagra online australia sildenafil 60mg price viagra pills 150 mg

  80. sildenafil for sale usa viagra canada otc cheap viagra wholesale

  81. viagra pill otc viagra for women sale wholesale viagra

Leave a Reply