Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I configure my Active Directory LDAP server (Windows 2008) to enable certificate verification and client authentication.

Thanks, Gayathri

share|improve this question
What PKI Infrastructure do you have? What application do you want to use which does cert auth? – MichelZ Jul 25 '12 at 6:59

I assume that you want to import a certificate from an arbitrary CA. A Windows CA is able to publish certificates directly to an active directory user.

To map a certificate to a user account

  1. Open Active Directory Users and Computers.
  2. On the View menu, select Advanced Features.
  3. In the details pane, click the user account to which you want to map a certificate.
  4. On the Action menu, click Name Mappings.
  5. In the Security Identity Mapping dialog box, on the X.509 Certificates tab, click Add.
  6. Type the name and path of the .cer file that contains the certificate you want to map to this user account, and then click Open.

Confirm that both the Use Issuer for alternate security identity and the Use Subject for alternate security identity check boxes are selected.

After this, you should be able to authenticate with the certificate against this user. Your application of course has to support Active Directory Certificate authentication.

share|improve this answer
For client authentication I have done the below procedure in AD server. Start ->Administrative tool -> Internet Information Services (IIS) Manager ->Connections->authentication -> Active Directory client certificate - authentication -> Enabled. Then also am able to connect to the server without uploading the certificate. Please let me shall i need to ass some more setting to mandate the client authentication in server configuration – gayathri Jul 26 '12 at 6:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.