AsiaTech: Microsoft APGC Internet Developer Support Team

We focus on various troubleshooting plan and solution on IIS web platform and distributed applications

How to configure IIS client certificate mapping authentication for IIS7

How to configure IIS client certificate mapping authentication for IIS7

Rate This
  • Comments 2

There are some articles about how to configure the Mutual Certificate authentication on IIS. But the steps are not very clear. Here is a detailed step by step procedure to configure the IIS client certification mapping authentication for IIS 7.

Firstly, there are several pre-requisites.

  1. Trusted CA root certificate.
  2. Server Certificate from a trusted CA.
  3. Client Certificate from a trusted CA.

Server side:

Install the server certificate on the server side.

1. Open mmc console, add the certificate for the Local Computer.



2. Import the CA root certificate to Trusted Root Certification Authorities and server certificate to Personal folder.


IIS configuration:

1. Open Inetmgr, click Server Certificates.


2. Import the server certificate as below.


3. Click the website which need mutual certificate authentication. Click bindings… and set it as below. Select the imported server certificate in the SSL certificate dropdown list.


4. Click SSL settings in the middle panel and select Require SSL and Require for Client certificates.


5. Double click the Authentication icon and disable all the Authentication method.


6. Make sure the IIS Client Certificate Mapping Authentication is installed.


If not, please install it as below.


7. Click the Configuration Editor in the middle panel and set the one to one mappings refer to this link .

You can also configure this by install the Client Certificates UI by this link.

On the client side:

1. Open MMC console and import the client certificate and CA root certificate. Import them to the Current User account.


2. Check if the client certificate exist in the content->certificate as below.


3. Try to visit the website and the client certificate will pop up. This is not popped up if there is only one client certificate by default. Here I configure the IE browser to prompt the dialog even only one client certificate is available. Please do it as below.



4. Here you go.





Chao Liang from GBSD DSI Team

Leave a Comment
  • Please add 4 and 5 and type the answer here:
  • Post
  • Great help


  • Hi,  I followed your steps but I am getting the error message as

    Error message that I am seeing is “(Error(HTTP 403 forbidden) means that Internet Explorer was able to connect to the website , but it does not have permission to view the web page)”

    Any Help

Page 1 of 1 (2 items)