Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an IIS 7 hosted site that requires client certificates (two-way ssl). Unfortunately, I don't have access to the trusted certificate store on the host machines, and so I was forced to write a custom http module to verify the certificates. My module never gets a chance to do the authentication, however, because IIS doesn't recognize the certificates and responds with a 403.7 error. How do I turn off client certificate validation, while still requiring clients to provide them?

share|improve this question
So you want to force the client to sned a certificate, but you don't want to validate it, so they could send any old certificate? – Sam Oct 7 '09 at 14:24

If you don't have access to the cert store, does that mean that you don't have admin access to IIS either?

If you do happen to have admin access, can you move your module up in the priority order? The order that the modules run is important.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.