CODEWITHSUNDEEP
iissslhttpscertificate
MrProgram
MrProgram

Reputation: 5242

how to use client certificates to access website

I have website hosted on IIS. My main issue is that I want only users with a specific certificate installed to be able to access the site. I tried to follow some tutorials but I can't find anyone covering both server and client side, since I can't get it to work.

I have some questions to the main issue:

As you may noticed by now I'm not sure how to do all of this, and would really like some help..

Upvotes: 2

Views: 7631

Answers (1)

pepo
pepo

Reputation: 8877

  1. Server should use SSL server certificate. This certificate has to have Server Authentication extension in Extended key usage. Server certificate should have SAN extension (Subject alternative name) with domain name of server as DNS name (i.e. somesite.com)
  2. CA certificate has to be imported to Trusted root store (preferably Local Machine) on both server and client machines.
  3. Client certificate should contain Client Authentication extension in Extended key usage.

All EndEntity (client and server) certificates should have CRL distribution point in them where there is URL to CRL that is issued by CA. CRL has to be accessible by both client and server and should be always valid.

You can use XCA for training purposes. It has a nice GUI and it has templates for CA, SSL server and SSL client certificates by default. Then you can mimic these certificates in your Active Directory Certificate Services. Documentation and some guides can be found here.

Upvotes: 3

Related Questions