Using self signed client certificate in development

Question

I'm trying to set up a dev env for a web application that require ssl + client certificate. So the server & client is the same, it's my laptop.

What's I've done so far, using several different tutorial found on the net:
- Created a self signed Root CA
- Created a "Server" certificate using this root CA, and configure IIS ssl with this certificate.
- Created a "Client" certificate (still using the same root certificate), with all roles

The command used to create certificates looks like this:

makecert -n "CN=Dev Client" -iv DevCA.pvk -ic DevCA.cer -pe -ss my -sr localmachine -sv DevClient.pvk DevClient.cer
pvk2pfx -pvk DevClient.pvk -spc DevClient.cer -pfx DevClient.pfx

So both Client & Server certificate has the same root certificate.

Then I:
- Added the Root certificate in the "Trusted authority store" of both current user and local machine
- Added the Client certificate in the "Personal store" of "Current user"
- Added the Server certificate in the "Personal store" of "Local computer"

When I check Client certificate properties, it correctly found the root certificate.

But now, the problem is that it doesn't works in IIS.
If I set client certificate as "required", I've an HTTP 403.4 Forbidden
If I set client certificate as "accepted", the site indeed works but doesn't receive the certificate

Does someone know how to make this works?

Answer 1

You should use

makecert ... -sky exchange

for server certificate and

makecert ... -sky signature

for client certificate in order to server has the ability to secure connection and client has the ability to authenticate himself.