IIS requesting certificates even though set to ignore

Question

I have a web site in IIS 6 with directory security set to Require secure channel (SSL) and Require 128-bit encryption. Also, the Client certificates setting is set to "Ignore client certificates".

When I hit https://servername/resource in Internet Explorer and Chrome , I am prompted for a certificate. I can cancel the prompt, and the resource will load, but I don't want to see this prompt at all. I looked at the virtual directories and resources within the web site, and they all have the ignore client certificates setting on. Could there be another setting, perhaps in the metbase, that is overriding the web site's directory security settings?

Answer 1

It is possible your port was configured using netsh and configured to accept client certificates. use "netsh http show sslcert" in cmd prompt to see if that is the case.

See here for more info: How to configure a port with an ssl certificate

I know this is a super old post, but leaving this answer here since it took us a long time and a Microsoft engineer to figure out why our server was doing the same thing.

Answer 2

Client certificates are different to SSL certificates.

A client certificate is sent from the client to the server to prove their identity, as opposed to sending a username and password.

An SSL certificate is sent from the server to the client, to prove the authenticity of the domain holder.

Which means "ignore client certificates" option does not affect HTTPS connections in any way. Most browsers will always prompt if the certificate is expired, self signed, or not trusted for some reason. You are probably using a self signed certificate.