We have an internal web application hosted on IIS 8 that exposes some REST services through HTTPS. Since it's accessed by other applications, we require client certificates. We are getting some authentication failures due to missing or bad client certificate, but we need them to be recorded as Windows Events so we can use our monitoring infrastructure. How can we properly configure IIS 8, running on Windows Server 2012, to forward client certificate authentication failures errors so they appear on Windows Events? Is there any special server Feature that needs to be installed and running in order for this to work?
As far as I know there is no built-in way to forward any IIS request related errors to the Windows event log.
Certificate related errors should show up in the http logs with a special sub-code (403.7,403.13,403.16,403.17) so you can write a short PowerShell script to run once an hour, going through all log files and looking for these subcodes. Then for each matching request or an aggregated summary writing an entry to the Windows event log.