There are some articles about how to configure the Mutual Certificate authentication on IIS. But the steps are not very clear. Here is a detailed step by step procedure to configure the IIS client certification mapping authentication for IIS 7.
Firstly, there are several pre-requisites.
- Trusted CA root certificate.
- Server Certificate from a trusted CA.
- Client Certificate from a trusted CA.
Server side:
Install the server certificate on the server side.
1. Open mmc console, add the certificate for the Local Computer.
2. Import the CA root certificate to Trusted Root Certification Authorities and server certificate to Personal folder.
IIS configuration:
1. Open Inetmgr, click Server Certificates.
2. Import the server certificate as below.
3. Click the website which need mutual certificate authentication. Click bindings… and set it as below. Select the imported server certificate in the SSL certificate dropdown list.
4. Click SSL settings in the middle panel and select Require SSL and Require for Client certificates.
5. Double click the Authentication icon and disable all the Authentication method.
6. Make sure the IIS Client Certificate Mapping Authentication is installed.
If not, please install it as below.
7. Click the Configuration Editor in the middle panel and set the one to one mappings refer to this link http://blogs.iis.net/rlucero/archive/2008/05/23/iis-7-walkthrough-one-to-one-client-certificate-mapping-configuration.aspx .
You can also configure this by install the Client Certificates UI by this link. http://www.iis.net/downloads/community/2009/08/iis-70-ui-module-for-client-certificate-mapping
On the client side:
1. Open MMC console and import the client certificate and CA root certificate. Import them to the Current User account.
2. Check if the client certificate exist in the content->certificate as below.
3. Try to visit the website and the client certificate will pop up. This is not popped up if there is only one client certificate by default. Here I configure the IE browser to prompt the dialog even only one client certificate is available. Please do it as below.
4. Here you go.
Regards,
Chao Liang from GBSD DSI Team