Ask the Expert

Mapping Windows client certificates

I have a Windows 2003 server, which has a certificate and is configured to require client certificates for the Web site. I followed Microsoft's procedures to map client certificates, and researched workarounds to replace expired certificates in the certificate stores. I tried moving certificates to different stores in order to get the client certificates to work. When I attempt to access a site, I receive a "client certificates required" error. If I check "accept client certificates," I can connect from the client, but if I select "require client certificates," I can't. Each site I browse to has a different response. One displays the message that I need a certificate and the other informs me that I must use one of the certificates in the list, but the list is empty. I have the client certificates on my client workstation and have even tried exporting/importing to my trusted root store on the client. I am on the same internal network as the server. It has two NIC's (internal and external) and I get the same response whether I try to connect internally or externally. It has the same problem from a Windows 2000 client or Windows XP client.

Requires Free Membership to View

Since you're running Microsoft Windows Server 2003, I assume you're also running Internet Information Services (IIS) version 6.0, which is good because it's more secure than earlier versions. The reason you can connect to the server from the client when you select the "Accept client certificates" option is because your server will let you access the resource, even if you don't have a valid client certificate. When you select the "Require client certificates" option, your server will request to see a client certificate before connecting to the resource. If a valid certificate is not presented, access will be denied.

If you are mapping client certificates to Windows user accounts, use the "Enable client certificate mapping" option. The server will compare its client certificate to the one the browser sent and they must be identical for the mapping to proceed. Therefore, if a user obtains a new certificate it must be remapped -- even if it contains all of the same user information. Also, some client certificates will need to be exported in order to use IIS's one-to-one mapping feature.

To export a client certificate for one-to-one mapping, open Internet Explorer, go to the tools menu, select Internet Options and then the Content tab. Next select Certificates, and then the Personal tab. Once you're there, select the certificates that you want and click Export. This will start the Certificate Export Wizard. Once this process has started, it's important to select the following options -- "No, do not include any private keys in the export" and "Base64 Encoded X.509 (*.CER)." The exported certificate will need to be copied to a secure location on the Web server so it can be mapped to a user account on the Web server.

You could have also received this error message if the Certificate Authority's (CA) client certificate has not been installed. Your Web server has a list of trusted CA certificates that determines which certificates the server will accept. If the CA that issued the client certificate is not on this list, the client won't be authenticated. On a final note, you mention that there is more than one site on the server, and each site will need its own Web server certificate. I recommend checking the validity of the client certificate's start and end dates, and whether it has been revoked.

This was first published in February 2006