Can Client certificate settings be configured in t

Question

I'm working with an SSL application and am wanting to control which folders ignore, require or accept client certifications.

The end goal is to have a sub-folder of the webApp ignore client certification. I do not want to do this via IIS because it will have to be replicated across the entire web farm.

Any ideas?

Answer 1

You can use a combination of the access section and locations in web.config (or web.configs in the appropriate subdirectories) to configure this.

For example, to require an SSL certificate in the directory Interface, you can add the following block to your web.config's configuration section:

  <location path="Interface">
    <system.webServer>
      <security>
        <access sslFlags="Ssl,SslRequireCert" />
      </security>
    </system.webServer>
  </location>

NOTE: as @Jonathan DeMarks stated in his comment, I've also needed to include SslNegotiateCert to get it to work (with IIS 8.5 & Chrome). So the working config for me is: sslFlags="Ssl,SslRequireCert,SslNegotiateCert" In fact I got an error stating that I was specifying SslRequireCert but I could meant to use SslNegotiateCert.

Note that if you want to require Ssl, you have to add it and the appropriate certificate flag.

The flag values from the technet documentation are:

None. This default setting disables SSL for the site or application.

Ssl. The site or application requires SSL.

SslNegotiateCert. The site or application accepts client certificates for authentication.

SslRequireCert. The site or application requires client certificates for authentication. Ssl128. The site or application requires 128-bit SSL certificate encryption.

HOWEVER

The access section cannot be overriden by default.

In order to support this, you must modify applicationHost.config in C:\Windows\System32\inetsrv\config (or appropriate directory for your install) and change the following line:

<section name="access" overrideModeDefault="Deny" />

to:

<section name="access" overrideModeDefault="Allow" />