Can Client certificate settings be configured in the web.config

Question

I'm working with an SSL application and am wanting to control which folders ignore, require or accept client certifications.

The end goal is to have a sub-folder of the webApp ignore client certification. I do not want to do this via IIS because it will have to be replicated across the entire web farm.

Any ideas?

Solution

You can use a combination of the access section and locations in web.config (or web.configs in the appropriate subdirectories) to configure this.

For example, to require an SSL certificate in the directory Interface, you can add the following block to your web.config's configuration section:

  <location path="Interface">
    <system.webServer>
      <security>
        <access sslFlags="Ssl,SslRequireCert" />
      </security>
    </system.webServer>
  </location>

NOTE: as @Jonathan DeMarks stated in his comment, I've also needed to include SslNegotiateCert to get it to work (with IIS 8.5 & Chrome). So the working config for me is: sslFlags="Ssl,SslRequireCert,SslNegotiateCert" In fact I got an error stating that I was specifying SslRequireCert but I could meant to use SslNegotiateCert.

Note that if you want to require Ssl, you have to add it and the appropriate certificate flag.

The flag values from the technet documentation are:

None. This default setting disables SSL for the site or application.

Ssl. The site or application requires SSL.

SslNegotiateCert. The site or application accepts client certificates for authentication.

SslRequireCert. The site or application requires client certificates for authentication. Ssl128. The site or application requires 128-bit SSL certificate encryption.

HOWEVER

The access section cannot be overriden by default.

In order to support this, you must modify applicationHost.config in C:\Windows\System32\inetsrv\config (or appropriate directory for your install) and change the following line:

<section name="access" overrideModeDefault="Deny" />

to:

<section name="access" overrideModeDefault="Allow" />

Comments

[Jonathan DeMarks]

I had to also add SslNegotiateCert or there was an error, so it ended up looking like this: <access sslFlags="Ssl,SslRequireCert,SslNegotiateCert"/>

[Rehan]

I have used your solution and it workds fine on my local and testing envoirment, but on clients server it gives 500 error can you help me on that what could be the reason machien is Server 2012 R2

[Ask]

Can we achieve this functionality in .Net Core? <access sslFlags="Ssl,SslRequireCert" />

[Johan Danforth]

Editing the applicationHost.config file required me to first become the owner of that file. It was also impossible to open and edit it in some editors, had to use Notepad, weirdly enough :) (on windows server 2012 r2)

[BrainSlugs83]

... so, how can you do this in a source controlled environment. Is there no built-in way to configure this without doing custom manual machine configuration editing?