Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a programmer in the process of writing Web Services on a website for a specific client. These Web Service can only be accessed by this one client. They intend to send a client certificate over SSL with each request, and I need to verify the identity of the requestor based on the certificate. We currently have an SSL certificate which the client will use to verify our identity.

I am a programmer, so security/certificates is not something I'm very familiar with, but, I am tasked with figuring it out. How do I go about setting this up? This needs to be setup for Windows Server 2003 R2 running IIS 6.

share|improve this question

You need to have the client present a certificate, and have your web server validate that certificate / map it to a "user" -- From there your software can usually treat it like Basic Auth information.

I can't help you much with the IIS particulars, but the Apache docs are a good general primer, and this page from may be of some help too. A careful poking around on Google ("Certificate based client authentication" or "client certificate authentication") will probably also turn up some useful stuff.

share|improve this answer
Thanks for the suggestions – Eric Belair Nov 15 '11 at 16:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.