I'm a programmer in the process of writing Web Services on a website for a specific client. These Web Service can only be accessed by this one client. They intend to send a client certificate over SSL with each request, and I need to verify the identity of the requestor based on the certificate. We currently have an SSL certificate which the client will use to verify our identity.

I am a programmer, so security/certificates is not something I'm very familiar with, but, I am tasked with figuring it out. How do I go about setting this up? This needs to be setup for Windows Server 2003 R2 running IIS 6.


You need to have the client present a certificate, and have your web server validate that certificate / map it to a "user" -- From there your software can usually treat it like Basic Auth information.

I can't help you much with the IIS particulars, but the Apache docs are a good general primer, and this page from iis.net may be of some help too. A careful poking around on Google ("Certificate based client authentication" or "client certificate authentication") will probably also turn up some useful stuff.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.