We have an IIS 7 hosted site that requires client certificates (two-way ssl). Unfortunately, I don't have access to the trusted certificate store on the host machines, and so I was forced to write a custom http module to verify the certificates. My module never gets a chance to do the authentication, however, because IIS doesn't recognize the certificates and responds with a 403.7 error. How do I turn off client certificate validation, while still requiring clients to provide them?

  • So you want to force the client to sned a certificate, but you don't want to validate it, so they could send any old certificate? – Sam Cogan Oct 7 '09 at 14:24

If you don't have access to the cert store, does that mean that you don't have admin access to IIS either?

If you do happen to have admin access, can you move your module up in the priority order? The order that the modules run is important.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy