I have a .NET MVC Application which is hosted in IIS. Users of the Application will be company only and it will be access so it will be on the intranet - app wont be exposed via internet. Within IIS I created a new Certificate Request (though I wasnt asked to enter a private key at all doing this from the wizard within IIS) - our company signed that with our trusted root CA and then I completed that Certificate Request in IIS and when I hit my IIS server I get my application coming up fine.
What I need to do now is set up 2 way mutual authentication with another application which is also hosted internally within the company but is hosted on a Tomcat Server.
So there is a RESTful service on the application that is hosted on Tomcat that I need to hit from my MVC controller action. So from my HomeController Index action I need to hit a RESTful service on the Tomcat application. The authentication I need to have in place between .NET app and Tomcat App is 2 way mutual authentication with certificates. Can anyone advise on the correct way to set up this two way mutual auth with certs between IIS and Tomcat. Should I give the admin of the Tomcat sever the CSR I created and they will give me the certificate they have generated for their app on Tomcat? Im not sure what I should do with the certificate I get from the Tomcat App - should it be installed within MMC?
And what is the correct way to connect to teh RESTful Service on Tomcat using the certs we both have in place to make sure that both Applications trust each other?