2-way SSL - is it possible to accept multiple client certs on one IIS site?

Question

A client has asked us to build an API which requires two-way SSL. Will we be able to expose that same API to other clients with different certificates? Or will we have to set up a different endpoint for each different client certificate?

We'll be hosting it in IIS, and both parties will be using proper CAs (I mean like Thawte, not self-signed).

Answer 1

Side note: this question is probably better suited to ServerFault.

Yes you can! There's full steps for setting everything up here, but the short version is that you need to use the IIS "Configuration Editor" tool, in the Client Certificate Mapping Authentication section

system.webServer/security/authentication/iisClientCertificateMappingAuthentication

and then go into the "oneToOneMappings" UI and hit "Add" for each user. Specify their cert (and user details), and there you go: their cert will now map to a user that web applications or other access-controlled resources can identify and authorize (or not).

Answer 2

You can surely do this with open source. So I think it is possible with IIS as well. Assuming you mean ** TLS Client Authentication** (2-way SSL).

With Apache2 Client Authentication works by exposing the authenticated user's data to your web application. Here is a sample app I put together to demo TLS Client Authentication. Here are the relevant pieces.

Config to use TLS Client Auth (this works w/ a single root, but you can also use multiple CAs by specifying SSLCACertificatePath instead of SSLCACertificateFile):

<VirtualHost *:443>
    ...
        SSLVerifyClient optional
        SSLVerifyDepth 1
        SSLCACertificateFile "/etc/ssl/private/ca.crt"
        SSLOptions +StdEnvVars
    ...

</VirtualHost>

The SSLOptions +StdEnvVars exposes the client certificate's data as an environment variable to your PHP script. You can then access it like so.

<?php
  echo $_SERVER['SSL_CLIENT_S_DN'];
  echo $_SERVER['SSL_CLIENT_S_DN_CN'];
?>

This way you can verify which client is authenticating in your web application. I am not familiar with how IIS handles these cases, but I think it is supported in some way. The key is to have it configured in a way to use multiple CAs when authenticating the clients. This post should help.

Alternatively, you can check out other authentication methods that provide a similar level of protection that TLS Client Certificates do.