Can Client certificate settings be configured in the web.config

I’m working with an SSL application and am wanting to control which folders ignore, require or accept client certifications.

The end goal is to have a sub-folder of the webApp ignore client certification. I do not want to do this via IIS because it will have to be replicated across the entire web farm.

Any ideas?

Contents hide

Answers:

Method 1

Method 2

Answers:

Thank you for visiting the Q&A section on Magenaut. Please note that all the answers may not help you solve the issue immediately. So please treat them as advisements. If you found the post helpful (or not), leave a comment & I’ll get back to you as soon as possible.

Method 1

You can use a combination of the access section and locations in web.config (or web.configs in the appropriate subdirectories) to configure this.

For example, to require an SSL certificate in the directory Interface, you can add the following block to your web.config’s configuration section:

  <location path="Interface">
    <system.webServer>
      <security>
        <access sslFlags="Ssl,SslRequireCert" />
      </security>
    </system.webServer>
  </location>

NOTE: as @Jonathan DeMarks stated in his comment, I’ve also needed to include SslNegotiateCert to get it to work (with IIS 8.5 & Chrome). So the working config for me is:
sslFlags="Ssl,SslRequireCert,SslNegotiateCert"
In fact I got an error stating that I was specifying SslRequireCert but I could meant to use SslNegotiateCert.

Note that if you want to require Ssl, you have to add it and the appropriate certificate flag.

The flag values from the technet documentation are:

None. This default setting disables SSL for the site or application.

Ssl. The site or application requires SSL.

SslNegotiateCert. The site or application accepts client certificates for authentication.

SslRequireCert. The site or application requires client certificates for authentication.
Ssl128. The site or application requires 128-bit SSL certificate encryption.

HOWEVER

The access section cannot be overriden by default.

In order to support this, you must modify applicationHost.config in C:WindowsSystem32inetsrvconfig (or appropriate directory for your install) and change the following line:

<section name="access" overrideModeDefault="Deny" />

to:

<section name="access" overrideModeDefault="Allow" />

Method 2

The way I got this to work the same way as in IIS (Display certificate dialog in Browser, and if not selected return 403.7) is by using this sequence in this order in web.config: Ssl,SslNegotiateCert,SslRequireCert.

So, section looks like this:

<location path="Interface">
<system.webServer>
  <security>
    <access sslFlags="Ssl,SslNegotiateCert,SslRequireCert" />
  </security>
</system.webServer>

All methods was sourced from stackoverflow.com or stackexchange.com, is licensed under cc by-sa 2.5, cc by-sa 3.0 and cc by-sa 4.0

0 0 votes

Article Rating