Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to configure a web site hosted under IIS 7.5 so that requests to a specific location require client certificate authentication. With my current setup, I still get a "401 - Unauthorized: Access is denied due to invalid credentials" when accessing the location with my client cert.

Here's the web.config fragment that sets things up:

<location path="MyWebService.asmx">
    <system.webServer>
      <security>
        <access sslFlags="Ssl, SslNegotiateCert"/>
        <authentication>
          <windowsAuthentication enabled="false"/>
          <anonymousAuthentication enabled="false"/>
          <digestAuthentication enabled="false"/>
          <basicAuthentication enabled="false"/>
          <iisClientCertificateMappingAuthentication enabled="true" oneToOneCertificateMappingsEnabled="true">
            <oneToOneMappings>
              <add enabled="true" certificate="MIICFDCCAYGgAwIBAgIQ+I0z6z8OWqpBIJt2lJHi6jAJBgUrDgMCHQUAMCQxIjAgBgNVBAMTGURldiBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTAxMjI5MjI1ODE0WhcNMzkxMjMxMjM1OTU5WjAaMRgwFgYDVQQDEw9kZXYgY2xpZW50IGNlcnQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANJi10hI+Zt0OuNr6eduiUe6WwPtyMxh+hZtr/7eY3YezeJHC95Z+NqJCAW0n+ODHOsbkd3DuyK1YV+nKzyeGAJBDSFNdaMSnMtR6hQG47xKgtUphPFBKe64XXTG+ueQHkzOHmGuyHHD1fSli62i2V+NMG1SQqW9ed8NBN+lmqWZAgMBAAGjWTBXMFUGA1UdAQROMEyAENGUhUP+dENeJJ1nw3gR0NahJjAkMSIwIAYDVQQDExlEZXYgQ2VydGlmaWNhdGUgQXV0aG9yaXR5ghB6CLh2g6i5ikrpVODj8CpBMAkGBSsOAwIdBQADgYEAwwHjpVNWddgEY17i1kyG4gKxSTq0F3CMf1AdWVRUbNvJc+O68vcRaWEBZDo99MESIUjmNhjXxk4LDuvV1buPpwQmPbhb6mkm0BNIISapVP/cK0Htu4bbjYAraT6JP5Km5qZCc0iHZQJZuch7Uy6G9kXQXaweJMiHL06+GHx355Y="/>
            </oneToOneMappings>
          </iisClientCertificateMappingAuthentication>
        </authentication>
      </security>
    </system.webServer>
</location>

The client certificate I'm using in my web browser matches what I've placed in the web.config. What am I doing wrong here?

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

I was getting the same error when i added the mappings at the application config. I saw this post http://blogs.msdn.com/b/rakkimk/archive/2009/07/08/iis7-configuring-iisclientcertificatemappingauthentication.aspx and moved my mapping entries to the website level and they get inherited by the application underneath and i only enabled IISClientCertificateAuthentication at the application level (disabled at the website level) and it started working.

Try moving the mappings to the configuration of the web site level and enable the client cert authentication at the application level. Good Luck and Happy New Year!

share|improve this answer
add comment

The error implies that the credentials you're using to access this site has not been granted permissions to access said site.

More information is required such as the purpose of this site and what credentials will your users be logging in under. Right now there isn't any authentication allowed even though forms authentication is noted. Like the previous reply above, move the authentication access/denied list to the server level.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.