Can Client certificate settings be configured in the web.config

Question

I\'m working with an SSL application and am wanting to control which folders ignore, require or accept client certifications.

The end goal is to have a sub-folder of

Answer 1

You can use a combination of the access section and locations in web.config (or web.configs in the appropriate subdirectories) to configure this.

For example, to require an SSL certificate in the directory Interface, you can add the following block to your web.config's configuration section:

  <location path="Interface">
    <system.webServer>
      <security>
        <access sslFlags="Ssl,SslRequireCert" />
      </security>
    </system.webServer>
  </location>

NOTE: as @Jonathan DeMarks stated in his comment, I've also needed to include SslNegotiateCert to get it to work (with IIS 8.5 & Chrome). So the working config for me is: sslFlags="Ssl,SslRequireCert,SslNegotiateCert" In fact I got an error stating that I was specifying SslRequireCert but I could meant to use SslNegotiateCert.

Note that if you want to require Ssl, you have to add it and the appropriate certificate flag.

The flag values from the technet documentation are:

None. This default setting disables SSL for the site or application.

Ssl. The site or application requires SSL.

SslNegotiateCert. The site or application accepts client certificates for authentication.

SslRequireCert. The site or application requires client certificates for authentication. Ssl128. The site or application requires 128-bit SSL certificate encryption.

HOWEVER

The access section cannot be overriden by default.

In order to support this, you must modify applicationHost.config in C:\Windows\System32\inetsrv\config (or appropriate directory for your install) and change the following line:

<section name="access" overrideModeDefault="Deny" />

to:

<section name="access" overrideModeDefault="Allow" />

Answer 2

The way I got this to work the same way as in IIS (Display certificate dialog in Browser, and if not selected return 403.7) is by using this sequence in this order in web.config: Ssl,SslNegotiateCert,SslRequireCert.

So, section looks like this:

<location path="Interface">
<system.webServer>
  <security>
    <access sslFlags="Ssl,SslNegotiateCert,SslRequireCert" />
  </security>
</system.webServer>