Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have followed these instructions to restrict access to my site to only users that I issue a certificate to, the server runs Windows 2008 R2 and IIS7.5.

The process of creating a self signed CA and user certificates signed by that CA worked no problem, then I installed my CA into trusted authorities and restarted the server. I have a real SSL certificate from GoDaddy assigned to my site so I didn't have to issue a self signed website certificate for that purpose.

Now the issue... I tried both manual editing using IIS Configuration Editor and this extension.

The problem is, when I map the user certificate (base 64 version) on IIS and try to browse the site I always get 401 after picking the certificate from the browser popup no matter what user name and password I put under the client certificate mapping, if I remove the certificate from the client certificate mapping the 401 error is gone and the page loads fine, as long as I don't map the certificate that I select on the browser popup the page loads fine.

The event log error when I map the client certificate is "Unknown user name or bad password.", 4625, without mapping the client certificate the page loads ok if I select the certificate but doesn't generate any event log like "success", if I don't pick the certificate it shows 403 Forbidden.

If I turn off anonymous authentication then it won't work either way, mapped or not mapped, some sites say anonymous is required by client certificate, others not.

I don't need to setup a Windows user on the web server for each certificate, right?

Why is the website loading successfully when I don't map the client certificate?

Any idea why my setup is not working when I actually map the certificate?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

I suspect the problem you are experiencing is that the system user to whom the certificate is mapped doesn't have the required permission to use your site.

Either map the user to the same user as anonymous authentication maps to, or provide permissions equivalent to those of the user anonymous authentication maps to for the user the certificate maps to.

share|improve this answer
    
Hi Falcon, from what you're saying I really need to map the client certificate to some user, either anonymous or actually create an user on the server for each certificate, that really makes sense, from the website that I was following the instructions it was written like this: "-> We didn’t care about mapping client certificates to any Windows user accounts, so we left the password field empty and typed in the user’s name into the userName field to easily identify the row and the certificate." That made me confused, how could he not map the user to a Windows account and it still work? –  paul-2011 Jul 7 '13 at 12:36
    
I wonder what are the advantages and disadvantages of mapping the client certificate as I have it currently working without any mapping, are there too many concerns about security if not mapped or after mapped as clients will gain a real user account on the server. Thanks –  paul-2011 Jul 7 '13 at 12:38
    
If you map the certificate to a user, IIS will basically use that user's permissions as the application permissions. That's all there is to it. I believe something else happens (anonymous auth?) if the user isn't valid. Also, the user associated with the certificate gets passed into the CGI somewhere in the environment... –  Falcon Momot Jul 7 '13 at 16:39
    
Gotcha, so without mapping it's the same as mapping as anonymous, that's why I need to keep anonymous authentication turned on to get it to work. 1. If I were to create a user for each certificate, what kind of use would it be (safest policy)? 2. My last doubt is, without mapping an user would it possible to restrict a client certificate to just a certain website? meaning, if I have 2 or more websites on IIS I would like each to accept only certain certificates. –  paul-2011 Jul 8 '13 at 14:33
    
You may want to open another question for that - extended discussion in comments is discouraged, as a rule. –  Falcon Momot Jul 8 '13 at 15:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.