CODEWITHSUNDEEP
asp.net-mvcsecurityauthenticationx509certificate
Andrew Arnott
Andrew Arnott

Reputation: 81771

How to require X.509 certificate authentication in ASP.NET MVC?

There's plenty of material on how to authenticate using an X.509 certificate via HttpWebRequest from the client side, but no certificate is actually sent because the server does issue the challenge to the client to send it. How can I configure an ASP.NET MVC site to require an X.509 client certificate for certain MVC actions?

Note, I've seen X.509 client auth configurations in IIS, but I don't want to always require X.509 -- just on certain actions.

Upvotes: 4

Views: 1705

Answers (1)

Mormegil
Mormegil

Reputation: 8071

AFAIAA, HTTPS handshake is always handled by IIS/Windows, you do not control it from your application. The only possible way is to have a specially configured part of your application which is set to require client certificate, and the rest without it. Then, when you want the user to submit his/her certificate, redirect them to that page in the special part (which will probably just store/validate the received certificate and redirect back).

Upvotes: 1

Related Questions