Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have an IIS 7 hosted site that requires client certificates (two-way ssl). Unfortunately, I don't have access to the trusted certificate store on the host machines, and so I was forced to write a custom http module to verify the certificates. My module never gets a chance to do the authentication, however, because IIS doesn't recognize the certificates and responds with a 403.7 error. How do I turn off client certificate validation, while still requiring clients to provide them?

share|improve this question
    
So you want to force the client to sned a certificate, but you don't want to validate it, so they could send any old certificate? –  Sam Oct 7 '09 at 14:24
add comment

1 Answer 1

If you don't have access to the cert store, does that mean that you don't have admin access to IIS either?

If you do happen to have admin access, can you move your module up in the priority order? The order that the modules run is important.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.