I want to get a security model implemented, but I'm not sure what terminology IIS/SSL uses in order to do that. Nor do I know how to make it happen in IIS7.5
The process I want to have
- Administrator users (multiple) of a website create a personal certificate (.p12/.pfx/something)
- Server operator installs one side of this certificate to IIS (for each admin)
- Administrator imports the other side of certificate to their browser
- Administrator then authenticates to their administration area of the website, using the SSL as a passport to be able to get anywhere near the admin login area
How would I go about implementing the model above? I pretty much require step by step with the certificate generation and IIS configuration. I'm unsure if I require some sort of windows based authentication on top of the website authentication and some sort of mapping of the certificates back to the windows user.
I'm guessing I'll need dedicated Windows Users for each administrator, with sync'd certificates. Note this is Win2k8 R2 + IIS 7.5, not exchange or domain driven stuff, just a plain server without all the AD crap.