Our production web application is running on iis 6 and has require ssl enabled and client certificates are required. I have a development version of the site on my computer running iis 7.5 which also requires ssl with client certificates required.
Both the production server and my development computer have valid Server Authentication certificates that are issued to the correct domain. Those certificates are located in the Personal store of the Local Computer on both the production server and my development computer. The issuer of those certificates is located in the Trusted Root Certification Authorities store of the Local Computer on both the production server and my development computer.
I have a smart card with two certificates on them (lets call them Cert1 and Cert2) as do our users. Both certificates are used for Smart Card Logon and Client Authentication. Cert2 is also used for Secure Email. The issuer of Cert1 and Cert2 is located in the Tusted Root Certification Authorities of the Local Computer on both the production server and my development computer. On my development computer, the issuer of the production site's certificate and my development site's certificate is located in the Trust Root Certification Authorities store of the Current User.
When visiting our site, we ask our users to use Cert2 when prompted for a certificate because that cert contains the user's email address as a property. We need that mainly for when the user requests an account for the site so that we don't have to prompt the user for their email address. After registration, it doesn't really matter which certificate they choose on subsequent visits because the certificates are otherwise pretty much identical.
When I access the production site on iis 6, I am only prompted for the certificate (and the associated PIN) once during the session. This works for both Cert1 and Cert2. Using Cert1 on the development site on iis 7.5 behaves as it does on production. However, when I use Cert2 to access my development site on iis 7.5, I am prompted for the certificate and then for every resource requested from the server (pages, images, style sheets, js, etc) I am prompted for the PIN. This results in multiple PIN prompts as I navigate the site and makes the registration process very frustrating.
I am concerned that once we upgrade the production server to Windows Server 2008 or higher, our users will experience the same problem. What could I possibly have mis-configured to cause Cert1 to work once for the entire session, but Cert2 only work on an item to item basis for the site running on iis 7.5?
I should mention I have tried this on Internet Explorer 7-11 and Chrome 32.0.1700.72 with the same result.