Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a web site in IIS 6 with directory security set to Require secure channel (SSL) and Require 128-bit encryption. Also, the Client certificates setting is set to "Ignore client certificates".

When I hit https://servername/resource in Internet Explorer and Chrome , I am prompted for a certificate. I can cancel the prompt, and the resource will load, but I don't want to see this prompt at all. I looked at the virtual directories and resources within the web site, and they all have the ignore client certificates setting on. Could there be another setting, perhaps in the metbase, that is overriding the web site's directory security settings?

share|improve this question

Client certificates are different to SSL certificates.

A client certificate is sent from the client to the server to prove their identity, as opposed to sending a username and password.

An SSL certificate is sent from the server to the client, to prove the authenticity of the domain holder.

Which means "ignore client certificates" option does not affect HTTPS connections in any way. Most browsers will always prompt if the certificate is expired, self signed, or not trusted for some reason. You are probably using a self signed certificate.

share|improve this answer
This really doesn't answer the question at all! – Anže Vodovnik Aug 18 '14 at 21:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.