1

I created self-signed root certificate, ssl certificate and client certificate using makecert util. I created site in IIS, enabled settings "Require SSL" and "Require client certificate". This site uses my ssl certificate. Then I installed client certificate on client PC and it works fine without any client certificate mappings. When it's required to configure mappings and when it's not needed?

0

Under the mapping, you can map individual users to tokens which can then have permission to see things or do tasks (Admins, Personnel, Customers, etc). Without that you're just testing to see if a user has a valid certificate regardless of who he is.
You can authenticate the users further using mechanisms like form authentication but the mapping can automate this task for you.

  • So if I just want to check whether user has client certificate or not I don't need to configure mappings, right? – mtkachenko Aug 9 '16 at 14:08
  • No but I don't recommend this in an enterprise environment, because then again you'd have to authentication your users further using some sort of username and passwords. What could happen is that user A can provide his client certificate and find user B's password and impersonate as B. By using client certificate mapping you can prevent this and strictly allow users to authenticate as their own users. – Silverfox Aug 9 '16 at 14:21
  • Thanks, it's interesting and I will reproduce this case "What could happen is that user A can provide his client certificate and find user B's password and impersonate as B." But actually I use client certificates for integration applications (no users, just one integration application needs to call another one wtih client certificate). So in my particular case I think it's ok. – mtkachenko Aug 9 '16 at 14:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.