ASP.NET and client certificates

[Craig Humphrey]

Hi People,

I know in IIS Admin you can tick the box to request a client certificate
(over an SSL connection), but does anyone know of a way, programmatically,
to force this to happen for a particular page for a particular user?

Basically I've got a site that uses a common code base to run, however we
want to offer differing levels of security, primarily, with and without the
use of client certs, but I haven't found an easy way to do this
programmatically...

The hard way, that I've thought of is:

if a cert is required (in the DB) for the current user
if a cert has been presented by the browser
validate it
else
return an HTTP 401 and WWW-Authenticate : client cert
fi
fi

But I'd rather not be doing this.
The user is already authenticated using Forms authentication over an HTTPS
connection.

Any other ideas?

Later'ish
Craig

 

[[MSFT]]

Hi Craig,

You may consider following solution:

1. You have a web diretory "PA" which reqiure client certificate.
2. After form authentication, when you find the user need client
certificate, you can redirect him to an ASPX page in "PA"
3. In the ASPX page, you can check the HttpClientCertificate from request
object, and redirect it back.

Does this help?

Luke
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)