Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I created a SelfSigned certificate for the webserver using selfssl. installed it on trusted root and personal. cretaed a selfsigned certificate for the client from clients machine, installed it on root and personal. i exported the certificate from client machine to Server and installed the clinet certificate on server. now when i go to the https;//mywebapp it gives me a reponse saying the page requires client certificate. what am i doing wrong in this process? i do not have CA in my domain to use it so i am having to use selfssl.

share|improve this question
add comment

1 Answer 1

up vote 0 down vote accepted

You may already be doing this, but here is a checklist that you can use to double-check everything is in the right place.
1) The Server cert that you create will need to have CN=URL for the website.
2) You will need to bind this cert to the actual website that you have created within your webserver (IIS).
3) Use the same machine to create your server and client certificates.
4) Import the server cert into the client machine so that the SSL tunnel with the https can be probably established when a client tried to connect to the website on the webserver. This will avoid those browser warnings on trusting certs that pops up
5) You will need to configure the website to either "allow" client certificates or "require" client certificates based on your requirements. This can be done from within IIS.
6) Also, you will need to enable client-side certificates (a checkbox within the IIS v 6.0 settings for the website) for the client cert mapping to come through.

Hope that this helps.

share|improve this answer
    
what do you do with the client certificate that is created in sever. i think that part is where the issue is –  Natasha Thapa Jul 15 '11 at 15:35
    
Do i need to create my own certificate authority? –  Natasha Thapa Jul 15 '11 at 20:52
    
You can be your own CA if you want. If you do, you can then install the root certificate along with the end-user client certificate on the client machines. This will make the browser happy so that it will no longer throw a warning message about the certificate is not a trusted certificate, do you wish to continue. The client certificates will need to be on imported into the personal certificate stores of the client machines. –  Yasser - TechToolbox Jul 19 '11 at 3:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.