Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm a programmer in the process of writing Web Services on a website for a specific client. These Web Service can only be accessed by this one client. They intend to send a client certificate over SSL with each request, and I need to verify the identity of the requestor based on the certificate. We currently have an SSL certificate which the client will use to verify our identity.

I am a programmer, so security/certificates is not something I'm very familiar with, but, I am tasked with figuring it out. How do I go about setting this up? This needs to be setup for Windows Server 2003 R2 running IIS 6.

share|improve this question

1 Answer 1

You need to have the client present a certificate, and have your web server validate that certificate / map it to a "user" -- From there your software can usually treat it like Basic Auth information.

I can't help you much with the IIS particulars, but the Apache docs are a good general primer, and this page from iis.net may be of some help too. A careful poking around on Google ("Certificate based client authentication" or "client certificate authentication") will probably also turn up some useful stuff.

share|improve this answer
    
Thanks for the suggestions –  Eric Belair Nov 15 '11 at 16:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.