require client certificates in IIS without requiring SSL

Question

In IIS 7, I've created an https binding for a site, and I'd like to require client certificates for https and still keep my http endpoint.

That is to say, I'd like to require client certificates for my https endpoint without requiring SSL across the board and disallowing access to my http endpoint (via "require SSL" in SSL Settings). Is this possible?

There is no way for the client to provide a certificate using HTTP (as opposed to HTTPS) using only transport layer security. — akton
i'd like to require client certificates without requiring SSL across the board (i'd like to keep the http endpoint, but require client certs for https) — user1325378

CJ Harmath CJ Harmath · Accepted Answer · 2012-10-03T04:15:17

Client certs are usually used for 2-way SSL, so not just the server but the client is also encrypting the traffic with it's private key.

If you don't want to enforce https across the board, then the one thing you can try is to accept the client cert ( see SSL settings ) then implement the cert validation in your application.

See Request.ClientCertificate on MSDN for more details

if (HttpContext.Current.Request.IsSecureConnection)
{
// it's SSL, so check the client cert
bool authorized = IsClientCertAuthorized(HttpContext.Current.Request.ClientCertificate)
}

Then implement that method as needed.

Note: I haven't tested this, so please comment if you've tried.

require client certificates in IIS without requiring SSL

1 Answers