Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have been trying to get a webservice we are creating to require client certificates for connections for several weeks and haven't been having much luck. I thought that I would attempt to make a simple website that requires client certificates to remove all the additional webservice code from the equation. Even though all the online tutorials made this look like it would be a much easier process, I've still had no luck. I'm not sure if I'm missing a settings in IIS or something simply isn't installed.

The server is Windows Server 2008 Web Edition. My local client box is Windows 7.

I have detailed every step I took to create this test website.

First I had to create my test certificates. From a Windows 7 SDK 7.1 Command Prompt on my local machine, I ran these commands:

    makecert.exe -r -n "CN=My Personal CA" -pe -sv MyPersonalCA.pvk -a sha1 -len 2048 -cy authority MyPersonalCA.cer

    makecert.exe -iv MyPersonalCA.pvk -ic MyPersonalCA.cer -n "CN=John Doe" -pe -sv JohnDoe.pvk -a sha1 -len 2048 -sky exchange JohnDoe.cer -eku 1.3.6.1.5.5.7.3.2

    pvk2pfx.exe -pvk JohnDoe.pvk -spc JohnDoe.cer -pfx JohnDoe.pfx -po password

After these commands, I had these files:

    MyPersonalCA.cer
    MyPersonalCA.pvk
    JohnDoe.cer
    JohnDoe.pfx
    JohnDoe.pvk

I then imported the following into IE on my local machine (Tools->Internet Options->Content->Certificates-Import): JohnDoe.pfx into the "Personal" store (in "Advanced" make sure that "Client Authentication" is selected) MyPersonalCA.cer into the "Trusted Root Certification Authrorities" store

On the server, I imported the follosing certs using the MMC Certificates snap-in:

    JohnDoe.cer into [Local Computer\Personal] and [Current User\Personal]
    MyPersonalCA.cer into [Local Computer\Trusted Root Certification Authorities] and
    [Current User\Trusted Root Certification Authorities]

I created a blank VB.NET (VS2008) web application and deployed it to the server. In IIS, I assigned this application to an application pool running as administrator to avoid any permissions issues (yes, I'll fix this later).

In IIS, I changes the SSL Settings for the application like this:

    Check "Require SSL"
    Under "Client Certificates", select "Require"

I also assigned 403.7 and 403.5 errors to custom error pages so I could tell which 403 error I was getting.

IE should prompt to select a client certificate when going to the page. Since newer versions of IE do not prompt if there are no matching certificates, I found an old box with IE6, and on that box (with the certificates installed) I do get the Client Certificate dialog box, but no certificates are listed. IE10 on my developer box never opens a prompt. I just get an immediate 403.7

Can anybody tell me where I am going wrong here? Does IIS require additional setup for this to work?

While submitting this question, I stumbled across another post talking about MakeCTL and netssh. From this I found that if I run:

    netssh http show sslcert

I get a list of settings including this:

    Negotiate Client Certificate : Disabled

Does this need to be turned on? If so, how do I turn this on? The limited instructions I've managed to find make it sound like I would need to delete the SSL binding and re-add it. I'm hesitant to play around with this since the server is in use.

share|improve this question
    
Try enabling IIS Failed Request tracing to see if that provides more information. learn.iis.net/page.aspx/266/…. Also see: stackoverflow.com/questions/6131458/… –  Greg Askew Mar 18 '13 at 15:18
    
I enabled Failed Request tracing. After getting a 403.7 I was able to see it in the log files, but nothing was really there that explained why. Anything in particular I should be looking for? The other link was solved by granting permissions to the certificate store. Since I have my app configured to run as administrator, I doubt that I have any permissions problems right now. Do you know if netsh needs to have "Negotiate Client Certficate : Enabled" for this to work? The article you linked makes it sound like this is for something else. –  fulgore66 Mar 18 '13 at 18:41
    
Administrators do not have permission to the certificate files, they have 'This folder only' permission to the folder: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys –  Greg Askew Mar 18 '13 at 18:46
    
My app was running with a domain admin. The folder you mentioned only seems to have local administrators with the special permissions. In any case, I changed the app pool user for the application from administrator to another domain account. It appears that "everyone" has permissions to the folder you mentioned, so this should work fine, correct? I'm still just getting a 403.7 error. Is there anything else the app pool user needs access to for this to work? –  fulgore66 Mar 18 '13 at 19:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.