How to require X.509 certificate authentication in ASP.NET MVC?

Question

There's plenty of material on how to authenticate using an X.509 certificate via HttpWebRequest from the client side, but no certificate is actually sent because the server does issue the challenge to the client to send it. How can I configure an ASP.NET MVC site to require an X.509 client certificate for certain MVC actions?

Note, I've seen X.509 client auth configurations in IIS, but I don't want to always require X.509 -- just on certain actions.

I've got the same question. Any progress on this?

DMCS
– DMCS

2010-12-28 19:43:08 +00:00
Commented Dec 28, 2010 at 19:43 — DMCS
– DMCS, Commented Dec 28, 2010 at 19:43

Mormegil · Accepted Answer · 2011-02-18 22:38:20Z

1

AFAIAA, HTTPS handshake is always handled by IIS/Windows, you do not control it from your application. The only possible way is to have a specially configured part of your application which is set to require client certificate, and the rest without it. Then, when you want the user to submit his/her certificate, redirect them to that page in the special part (which will probably just store/validate the received certificate and redirect back).

answered Feb 18, 2011 at 22:38

Mormegil

8,0774 gold badges44 silver badges81 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to require X.509 certificate authentication in ASP.NET MVC?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related