I'm looking for a way to setup IIS to process the client certificate authentication the same way as nginx does when the
optional_no_ca option is used for the
ssl_client_certificate directive. Basically, it means that IIS should get a client certificate chain during the SSL handshake, validate that the client has a private key of the provided certificate and that's it -- no further verification (like checking CRL, signature, dates). The rest of the client certificate verification would be done on the backend which is located behind the IIS server.
It was easy to find the relative configuration docs for:
- nginx https://nginx.ru/en/docs/http/ngx_http_ssl_module.html#ssl_verify_client
- apache https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslverifyclient
Unfortunately, I haven't managed to find any documentation describing the setup for IIS. Is it supported?