How can I verify a client's identity using an SSL handshake to allow access to certain website pages?

Question

I'm a programmer in the process of writing Web Services on a website for a specific client. These Web Service can only be accessed by this one client. They intend to send a client certificate over SSL with each request, and I need to verify the identity of the requestor based on the certificate. We currently have an SSL certificate which the client will use to verify our identity.

I am a programmer, so security/certificates is not something I'm very familiar with, but, I am tasked with figuring it out. How do I go about setting this up? This needs to be setup for Windows Server 2003 R2 running IIS 6.

Answer 1

You need to have the client present a certificate, and have your web server validate that certificate / map it to a "user" -- From there your software can usually treat it like Basic Auth information.

I can't help you much with the IIS particulars, but the Apache docs are a good general primer, and this page from iis.net may be of some help too. A careful poking around on Google ("Certificate based client authentication" or "client certificate authentication") will probably also turn up some useful stuff.