Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For me it is trivial to configure Tomcat for client authentication. But trying it to do it in an IIS 7 server (running in Win2008R2 Server) it seems imposible.

In tomcat all I have to do is configure the container with my truststore. How is this done in IIS?

All I can find is in SSL settings to request client authentication, but I can not see how can I install certificates my server will trust. What I want to do, is configure IIS to trust specific (client) certificates (not created by the domain controller though. I.e. be of any user).

How can I do this?
I followed the links, but could not get it to work.
Is there somewhere I can post, that IIS gurus could help??

share|improve this question

I have the following suggestion, based on using IIS Client Certificate Mapping to map many certificates to a single Windows account:

  1. Enable SSL.
  2. Require SSL certificates.
  3. Enable Windows Authentication and disable all other forms of authentication.
  4. Create a local Windows user with limited privileges (user belongs to the Guests group)
  5. Enable IIS Client Certificate Mapping. This has to be done through the command line or through the Configuration Editor in IIS Manager.

  6. Add mapping entries so that your desired certificates are mapped to the Windows account that you created in step 4.

share|improve this answer

Does this help?

share|improve this answer
I tried all the directions in your link.I created a server certificate and a client certificate from the same root CA.I installed root CA in the system (I could see it in Explorer).I did the mapping.As user name and password I used the user name and password of the administrator in the domain, just to see if it will work.The request client certificate was enabled in SSL setting.But I could not access the server.Got rejected.It seems that the certificate send by the browser was rejected.But I have configured browser to send the certificate from trusted root ca.How does it work in IIS? – user76678 May 2 '11 at 19:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.