2

I have website hosted on IIS. My main issue is that I want only users with a specific certificate installed to be able to access the site. I tried to follow some tutorials but I can't find anyone covering both server and client side, since I can't get it to work.

I have some questions to the main issue:

  • What kind of certificate should I use (domain/selfed signed in IIS 7.5)? I do have access to a Active Directory Certificate Services where I can create other types of certificates (CA), but the problem is when trying to import them to my IIS ("certificate cannot be used as an ssl server certificate")

  • I would like to use a CA certificate, but is that possible when using IIS? Or do I need to write all the code the check if the user has the right certificate?

  • When created a certificate for the website (e.g. though IIS)..How do I create user certificates that are trusted by the server certificate?

As you may noticed by now I'm not sure how to do all of this, and would really like some help..

MrProgram
  • 5,044
  • 13
  • 58
  • 98

1 Answers1

3
  1. Server should use SSL server certificate. This certificate has to have Server Authentication extension in Extended key usage. Server certificate should have SAN extension (Subject alternative name) with domain name of server as DNS name (i.e. somesite.com)
  2. CA certificate has to be imported to Trusted root store (preferably Local Machine) on both server and client machines.
  3. Client certificate should contain Client Authentication extension in Extended key usage.

All EndEntity (client and server) certificates should have CRL distribution point in them where there is URL to CRL that is issued by CA. CRL has to be accessible by both client and server and should be always valid.

You can use XCA for training purposes. It has a nice GUI and it has templates for CA, SSL server and SSL client certificates by default. Then you can mimic these certificates in your Active Directory Certificate Services. Documentation and some guides can be found here.

pepo
  • 8,644
  • 2
  • 27
  • 42