{"id":1964,"date":"2017-03-23T21:14:38","date_gmt":"2017-03-23T21:14:38","guid":{"rendered":"http:\/\/obieta.com\/?p=1964"},"modified":"2017-03-23T21:14:38","modified_gmt":"2017-03-23T21:14:38","slug":"simplified-how-to-create-an-iis-website-that-requires-client-certificate-using-self-signed-certificates","status":"publish","type":"post","link":"http:\/\/obieta.com\/?p=1964","title":{"rendered":"Simplified: How to create an IIS website that requires client certificate using self-signed certificates"},"content":{"rendered":"
<\/div>\n
\n

Some IE\/IIS issues may involve client certificate. It always took me hours to deploy a test website that requires client certificate. Therefore, I am going to write this blog to record every steps including: creating self-signed root CA, server certificate, client certificate and configuring IIS.<\/p>\n

Prerequisites<\/h2>\n\n\n\n\n\n\n
Domain<\/td>\n<\/td>\n<\/tr>\n
IIS server<\/td>\niis-lab-server<\/code>\u00a0@ Windows Server 2012 R2 Standard<\/td>\n<\/tr>\n
Client machine<\/td>\niis-lab-client<\/code>\u00a0@ Windows 7 Enterprise<\/td>\n<\/tr>\n
Applications<\/td>\nmakecert.exe<\/code>\u00a0and\u00a0pvk2pfx.exe<\/code>. You can find the two EXEs from a system with Visual Studio installed. On a Windows 10 x64 PC with VS2015 installed, you can get them from:\u00a0C:\\Program Files (x86)\\Windows Kits\\10\\bin\\x64<\/code>.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Step 1: Creating self-signed root CA<\/h2>\n
    \n
  1. Create directory:\u00a0c:\\cert<\/code>\u00a0on the IIS server.<\/li>\n
  2. Copy\u00a0makecert.exe<\/strong>\u00a0and\u00a0pvk2pfx.exe<\/strong>\u00a0to\u00a0c:\\cert<\/code>.<\/li>\n
  3. \n

    Save following content as\u00a0c:\\cert\\CreateCARoot.cmd<\/code>.<\/p>\n

    makecert.exe ^\n-n \"CN=IIS Lab CARoot\" ^\n-r ^\n-pe ^\n-a sha512 ^\n-len 4096 ^\n-cy authority ^\n-sv CARoot.pvk ^\nCARoot.cer\n\npvk2pfx.exe ^\n-pvk CARoot.pvk ^\n-spc CARoot.cer ^\n-pfx CARoot.pfx ^\n-po Password1\n<\/code><\/pre>\n<\/li>\n
  4. \n
    Run CMD and execute\u00a0c:\\cert\\CreateCARoot.cmd<\/code>.<\/p>\n<\/li>\n
  5. \n
    Enter password:\u00a0Password1<\/code>\u00a0in following three password prompt dialogs.<\/p>\n<\/li>\n
  6. \n
    It will create three files:\u00a0CARoot.cer<\/code>,\u00a0CARoot.pfx<\/code>\u00a0and\u00a0CARoot.pvk<\/code>.<\/p>\n<\/li>\n
  7. \n
    Run\u00a0mmc<\/code>\u00a0on the IIS server to launch Console.<\/p>\n<\/li>\n
  8. \n
    Press\u00a0Ctrl+M<\/code>\u00a0or click\u00a0File \u2192 Add\/Remove Snap-in<\/code>, select\u00a0Certificates<\/code>, click\u00a0Add ><\/code>.<\/p>\n<\/li>\n
  9. \n
    Choose\u00a0Computer account<\/code>\u00a0and then click\u00a0Next<\/code>.<\/p>\n<\/li>\n
  10. \n
    Keep default settings, click\u00a0Finish<\/code>, then click\u00a0OK<\/code>.<\/p>\n<\/li>\n
  11. \n
    Right click\u00a0Trusted Root Certification Authorities \u2192 Certificate<\/code>, choose\u00a0All Tasks \u2192 Import<\/code>.<\/p>\n<\/li>\n
  12. \n
    Click\u00a0Next<\/code>, choose the self-signed root CA:\u00a0CARoot.cer<\/code>\u00a0and then click\u00a0Next<\/code>.<\/p>\n<\/li>\n
  13. \n
    Keep default settings, click\u00a0Next<\/code>\u00a0and then click\u00a0Finish<\/code>.<\/p>\n<\/li>\n
  14. \n
    The self-signed CA root will appear in the list.<\/p>\n<\/li>\n
  15. \n
    Copy the\u00a0CARoot.cer<\/code>\u00a0to the client machine and import it using the same steps.<\/p>\n<\/li>\n<\/ol>\n
    Step 2: Creating self-signed server certificate<\/h2>\n
      \n
    1. \n
      Save following content as\u00a0c:\\cert\\CreateServerCertificate.cmd<\/code>\u00a0on the IIS server.<\/p>\n
      makecert.exe ^\n-n \"CN=iis-lab-server.iislab.com\" ^\n-iv CARoot.pvk ^\n-ic CARoot.cer ^\n-pe ^\n-a sha512 ^\n-len 4096 ^\n-b 01\/01\/2014 ^\n-e 01\/01\/2040 ^\n-sky exchange ^\n-eku 1.3.6.1.5.5.7.3.1 ^\n-sv ServerCert.pvk ^\nServerCert.cer\n\npvk2pfx.exe ^\n-pvk ServerCert.pvk ^\n-spc ServerCert.cer ^\n-pfx ServerCert.pfx ^\n-po Password1\n<\/code><\/pre>\n<\/li>\n
    2. \n
      Run CMD and execute\u00a0c:\\cert\\CreateServerCertificate.cmd<\/code>.<\/p>\n<\/li>\n
    3. Enter password:\u00a0Password1<\/code>\u00a0in all password prompt dialogs.<\/li>\n
    4. It will create three files:\u00a0ServerCert.cer<\/code>,\u00a0ServerCert.pfx<\/code>\u00a0and\u00a0ServerCert.pvk<\/code>.<\/li>\n
    5. Go to the Certificate Console on the IIS server, right click\u00a0Personal \u2192 Certificate<\/code>, choose\u00a0All Tasks \u2192 Import<\/code>.<\/li>\n
    6. \n
      Change the file extension to\u00a0*.pfx*<\/code>\u00a0when selecting certificate and choose\u00a0ServerCert.pfx<\/code>\u00a0we just created.<\/p>\n<\/li>\n
    7. \n
      The self-signed server certificate will appear in the list.<\/p>\n<\/li>\n<\/ol>\n
      Step 3: Creating self-signed client certificate<\/h2>\n
        \n
      1. \n
        Save following content as\u00a0c:\\cert\\CreateClientCertificate.cmd<\/code>\u00a0on the IIS server.<\/p>\n
        makecert.exe ^\n-n \"CN=AnyClientInIISLab\" ^\n-iv CARoot.pvk ^\n-ic CARoot.cer ^\n-pe ^\n-a sha512 ^\n-len 4096 ^\n-b 01\/01\/2014 ^\n-e 01\/01\/2040 ^\n-sky exchange ^\n-eku 1.3.6.1.5.5.7.3.2 ^\n-sv ClientCert.pvk ^\nClientCert.cer\n\npvk2pfx.exe ^\n-pvk ClientCert.pvk ^\n-spc ClientCert.cer ^\n-pfx ClientCert.pfx ^\n-po Password1\n<\/code><\/pre>\n<\/li>\n
      2. \n
        Run CMD and execute\u00a0c:\\cert\\CreateClientCertificate.cmd<\/code>.<\/p>\n<\/li>\n
      3. Enter password:\u00a0Password1<\/code>\u00a0in all password prompt dialogs.<\/li>\n
      4. It will create three files:\u00a0ClientCert.cer<\/code>,\u00a0ClientCert.pfx<\/code>\u00a0and\u00a0ClientCert.pvk<\/code>.<\/li>\n
      5. Copy\u00a0ClientCert.pfx<\/code>\u00a0to the client machine.<\/li>\n
      6. \n
        On client machine, go to Management Console, add a new certificate snap-in, choose\u00a0My user account<\/code>\u00a0this time (not\u00a0Computer account<\/code>).<\/p>\n
        \n<\/li>\n
      7. \n
        Import\u00a0ClientCert.pfx<\/code>\u00a0into\u00a0Current user \u2192 Personal \u2192 Certificate<\/code>\u00a0on the client machine, the password is\u00a0Password1<\/code>.<\/p>\n<\/li>\n
      8. \n
        The self-signed client certificate will appear in the list.<\/p>\n
        \n<\/li>\n<\/ol>\n
        Step 4: Creating IIS website that requires client certificate<\/h2>\n
          \n
        1. \n
          Install IIS onto the IIS server, make sure that security components:\u00a0IIS Client Certificate Mapping Authentication<\/code>\u00a0and\u00a0Client Certificate Mapping Authentication<\/code>\u00a0are installed together.<\/p>\n<\/li>\n
        2. \n
          Open IIS manager (inetmgr.exe), there is a\u00a0Default Web Site<\/code>, next we will configure it to require client certificate.<\/p>\n<\/li>\n
        3. \n
          Right click\u00a0Default Web Site<\/code>\u00a0and click\u00a0Edit Bindings...<\/code>.<\/p>\n<\/li>\n
        4. \n
          We are going to add HTTPS 443 port for\u00a0Default Web Site<\/code>. Click\u00a0Add<\/code>, select\u00a0https<\/code>\u00a0for\u00a0Type<\/code>, choose the self-signed server certificate we created in step 2 for\u00a0SSL Certificate<\/code>.<\/p>\n<\/li>\n
        5. \n
          Default Web Site<\/code>\u00a0is now a HTTPS site, we can verify it by browsing to\u00a0https:\/\/iis-lab-server.iislab.com<\/a>\u00a0from the client machine.<\/p>\n<\/li>\n
        6. \n
          However the website currently does not require any client certificate, next let’s configure it to use client certificate.<\/p>\n<\/li>\n
        7. \n
          Go to\u00a0Default Web Site<\/code>\u00a0\u2192\u00a0SSL Settings<\/code>.<\/p>\n<\/li>\n
        8. \n
          Enable\u00a0Require SSL<\/code>, choose\u00a0Require<\/code>\u00a0for\u00a0Client certificate<\/code>\u00a0and then click\u00a0Apply<\/code>\u00a0to save the settings.<\/p>\n<\/li>\n
        9. \n
          Now we can use the client certificate to authenticate the website, next we are going to configure many-to-one certificate mapping.<\/p>\n<\/li>\n
        10. \n
          Go to\u00a0Default Web Site<\/code>\u00a0\u2192\u00a0Configuration Editor<\/code>.<\/p>\n<\/li>\n
        11. \n
          Select section:\u00a0system.webServer\/security\/authentication\/iisClientCertificateMappingAuthentication<\/code>.<\/p>\n<\/li>\n
        12. \n
          Choose\u00a0True<\/code>\u00a0for\u00a0enabled<\/code>, click the\u00a0...<\/code>\u00a0button in\u00a0manyToOneMappings<\/code>\u00a0field to add a many-to-one mapping rule.<\/p>\n<\/li>\n
        13. \n
          Click\u00a0Add<\/code>.<\/p>\n<\/li>\n
        14. \n
          Configure as below.<\/p>\n\n\n\n\n\n\n\n\n\n
          description<\/td>\nWhatever description text<\/td>\n<\/tr>\n
          enable<\/td>\nTrue<\/td>\n<\/tr>\n
          name<\/td>\nWhatever name<\/td>\n<\/tr>\n
          password<\/td>\nThe login password of the windows account you want the certificate to be mapped to<\/td>\n<\/tr>\n
          permissionMode<\/td>\nAllow<\/td>\n<\/tr>\n
          rules<\/td>\nYou can add rules as you want, like let the server to check whether the certificate is signed by the correct CA root.<\/td>\n<\/tr>\n
          userName<\/td>\nThe windows account you want the certificate to be mapped to<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
          \n<\/li>\n
        15. \n
          Close the window after you complete configuration. You will see the count of\u00a0manyToOneMappings<\/code>\u00a0increases to 1. Click\u00a0Apply<\/code>\u00a0to save the changes.<\/p>\n
          \n<\/li>\n
        16. \n
          Let’s verify from the client machine, open IE and browse to\u00a0https:\/\/iis-lab-server.iislab.com<\/a>, you will see the client certificate selection prompt. The website can be accessed by choosing the self-signed client certificate we created. If you cancel the prompt (means not using any client certificate) or choose a wrong client certificate, you will encounter 403 Access Denied error.<\/p>\n
          \n<\/li>\n
        17. \n
          If you don’t see the client certificate selection prompt, it might because you have only one client certificate exists and IE security setting:\u00a0Don't prompt for client certificate selection when only one certificate exists<\/code>\u00a0is enabled. You should be able to see the prompt after disabling the setting of the security zone that the site is mapped to.<\/p>\n
          Reblogged and Credits goes to:<\/p>\n
          http:\/\/joji.me\/en-us\/blog\/how-to-create-an-iis-website-that-requires-client-certificate-using-self-signed-certificates<\/li>\n<\/ol>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
          Some IE\/IIS issues may involve client certificate. It always took me hours to deploy a test website that requires client certificate. Therefore, I am going to write this blog to record every steps including: creating self-signed root CA, server certificate, client certificate and configuring IIS. Prerequisites Domain IIS server iis-lab-server\u00a0@ Windows Server 2012 R2 Standard […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"http:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/posts\/1964"}],"collection":[{"href":"http:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/obieta.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1964"}],"version-history":[{"count":0,"href":"http:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/posts\/1964\/revisions"}],"wp:attachment":[{"href":"http:\/\/obieta.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1964"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/obieta.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1964"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/obieta.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1964"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}