Client Certificate Support

[localhost]

I have an IIS6 site that does not have an SSL certificate installed.
I do not want to install a server SSL cert on the site.

I want to protect certain .aspx pages based on the availibility of the
web browser client certificate. I want to do something like this:

HttpClientCertificate clientCert = Request.ClientCertificate;
if ( clientCert.IsValid == true )
{
if ( clientCert.PublicKey == bytesIexpectToGet )
{
// Allow access to the page
}
}

But
(1) does that work with IE on Windows, IE on Mac, Netscape on Windows,
Opera on Windows, Safari on Mac?
(2) can I do the above without needing SSL certificates or any
non-default IIS Admin settings on the web server?

This is for an ISP hosted environment where I have no control over any
IIS settings.

Thanks.

 

[Steven Cheng[MSFT]]

Hi Localhost,

Thanks for posting in the community!
From your description, you'd like to manually obtain the client
certificates in your ASP.NET code without setting the certification
requirment on the IIS server, yes?
If there is anything I misunderstood, please feel free to let me know.

Based on my research, the client side certificate will be sent to the
requested site only if the site has configured to request the certain
certificate. Otherwise, no certificate will be sent. Here is the detailed
related document in MSDN:

#Request.ClientCertificate Collection
http://msdn.microsoft.com/library/en-us/iissdk/iis/ref_vbom_reqoccc.asp?fram
e=true

And here are some other references on Certificate Services

#Certificate Services
http://msdn.microsoft.com/library/en-us/security/security/certificate_servic
es.asp?frame=true

#Publishing Web Sites using Client Certificate Authentication
http://www.isaserver.org/tutorials/Publishing_Web_Sites_using_Client_Certifi
cate_Authentication.html

Please check out the preceding items. If you have any further questions,
please feel free to post here.



Regards,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

Get Preview at ASP.NET whidbey
http://msdn.microsoft.com/asp.net/whidbey/default.aspx