0

I have a website that's hosted on IIS 8.0 that I would like to require client certificates.

I know about how to enable this in IIS, but I'm unsure what is required in the certificate store on the server. Do I need to load each and every client certificate my users will be using into the certificate store? Or do I only need to ensure that the root of their certificate chain is among the trusted roots on my server? What about intermediate certificates in their chain?

Note : I am not using the client certificate mapper for active directory. I am doing application specific mapping within the hosted app itself.

Improve this question
1
  • In general you point a server (app) at a CA certificate and tell it to trust all users that identify themselves with a client certificate issued by that CA (and that maybe also have property X,Y and Z encoded in the client certificateif so required)
    – HBruijn
    Oct 3, 2016 at 4:50

1 Answer 1

Reset to default
1

If you client certificates were issued by a CA that is already in the trusted Root CA list in Windows (on your server) you don't have to do anything.

If the client certificates were signed by your own or another generally untrusted domain, you have to add the public key of that CA to your Trusted Root CAs.

The client certificates themselves should not be in the store on the server.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .