Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got an SSL certificate from the 3rd party certificate authority. It's a .cer file. The certificate is installed and working properly in IIS7.

The certificate displays its Intended Purposes as Server Authentication, Client Authentication.

The site requires authentication via client certificates. We're not using client certificate mapping, but simply using client certificates as a measure of authentication -- if you have one, you're authenticated.

  • How can I create a client certificate?
  • Does the CA have to do this, involving another CSR?
  • Is this something I can do myself with another tool? (OpenSSL or other)
  • What format is required for client certificates?
share|improve this question

Client certificate authentication in IIS (or most HTTPDs) is somewhat complicated. You have to map the users to the certificate. The certificates themselves can be issued by any CA that the server trusts; you can setup an AD CS instance to issue the certs, or even use a local copy of OpenSSL to create the certs if you wanted.

There's an article on describing Client Certificate Mapping; with information about enabling it and programmatically associating certificates with users.

The ultra-short version of issuing client certs with OpenSSL.

  1. openssl genrsa -des3 -out my_ca.key 4096
  2. openssl req -new -key my_ca.key -out my_ca.csr
  3. openssl x509 -req -days 365 -in my_ca.csr -signkey my_ca.key -out my_ca.crt
    You now have a CA certificate and key.
  4. For each of the client certificates you'll generate you need a Cert Signing Request. You can use the same cert for every user if you want, it's not a particularly good idea though and you should definitely require some other form of authentication as well (like a password). Either the clients can generate the CSRs themselves, or you can with openssl again (note that each CSR needs a private key first):
    openssl genrsa -des3 -out client1.key 1024
    openssl req -new -key client1.key -out client1.csr
  5. Edit your openssl.cnf file and fill in the relevant CA parts. They are:

    [ ca ]
    default_ca      = CA_default            # The default ca section
    [ CA_default ]
    dir            = ./                    # top dir
    database       = $dir/my_ca.index      # index file.
    new_certs_dir  = $dir/newcerts         # new certs dir
    certificate    = $dir/my_ca.crt        # The CA cert
    serial         = $dir/        # serial no file
    private_key    = $dir/my_ca.key        # CA private key
    RANDFILE       = $dir/rand             # random number file
    default_days   = 365                   # how long to certify for
    default_crl_days= 30                   # how long before next CRL
    default_md     = md5                   # md to use
    policy         = policy_any            # default policy
    email_in_dn    = no                    # Don't add the email into cert DN
    name_opt       = ca_default            # Subject name display option
    cert_opt       = ca_default            # Certificate display option
    copy_extensions = none                 # Don't copy extensions from request
    [ policy_any ]
    countryName            = supplied
    stateOrProvinceName    = optional
    organizationName       = optional
    organizationalUnitName = optional
    commonName             = supplied
    emailAddress           = optional
  6. Sign the key using the CA cert
    openssl ca -in client1.csr -out client1.crt

  7. If you created the key and CSR for the client you'll need to export them. Export the certificate pair to a PKCS12 file so the client can import it.
    openssl pkcs12 -export -in client1.crt -inkey client1.key -out client1.p12
  8. If you completed #7, send the client the PKCS12 file you created; otherwise send them the Certificate from #6.

Note that this is a poor way to issue signed certificates because it simply grants whatever type of certificate the CSR specified. Be sure to pay attention to what you're doing. If you're going to issue a lot of certificates you'll need to invest some time in a more secure setup.

share|improve this answer
thanks for the answer. I'm unfortunately not mapping the clients to AD accounts, but rather still stuck at the point of creating the certificates themselves. – p.campbell Aug 9 '10 at 18:50
The easiest two options by far are installing ADCS or using OpenSSL; Install one and I'll see if I can dig up directions for creating the CA Cert and issuing client certs. – Chris S Aug 9 '10 at 19:13
indeed OpenSSL would be preferable. – p.campbell Aug 9 '10 at 19:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.