Finally, run the following commands from the IIS installation root directory (usually C:\winnt\system32\inetsrv). The commands update the IIS metabase with the details of the CA you created:
Iisca
Net stop iisadmin /y
Net start w3svc
Issuing Client Certificates
Now you can begin issuing client certificates. Client certificates install directly to the browser. (All recent browsers from Netscape and Microsoft support client certificates; however, I will focus on IE 4.0) From the client, browse to http://server name/certsrv/certenroll/ceenroll.asp. The Certificate Enrollment Form lets you enter the details of the client certificate. Fill out all fields as appropriate and click Submit Request. When you submit this request, you call IE 4.0's Web Server Enrollment Page. Click Download on that page to install the client certificate to the browser. You can verify that the client certificate has installed properly by selecting View, Internet Options, Content, Personal. You will see the client certificate in IE 4.0's Client Authentication window.
After you install the client certificate, you need to let IIS know that the certificate holder is thereby authorized to access the secure area of your Web site. Because IIS bases Web security on NT user accounts, IIS needs a way to map each client certificate to an NT user or group account on the server. IIS uses the Client Certificate Mapping table to achieve this mapping. To create a client certificate mapping, you must import each client certificate individually from text files. Importing client certificates from text files, although a clunky process, appears to be the only supported method to create the required mappings. Thus, a method is necessary to capture client certificates installed in client browsers and store them in a text file. The easiest way to capture and store client certificates is to cut Active Server Pages (ASP) code to write the client certificates to a file. Listing 1 shows ASP code that will write client certificates to a text file.
Create a directory on your Web server to store the ASP file, and modify the path in the code as appropriate to write the certificate information to. The modified path appears in callout A of Listing 1. To enable the ASP file to create the text file (cert.txt in Listing 1), you need to allow the directory write permission in IIS. To set up a prompt that asks the client to submit a certificate, enable both https and Anonymous access to the directory in which you store the ASP file. To enable https and Anonymous access, reference the ASP file as https:// rather than http://. Clients running this ASP file will receive a prompt requesting submission of a client certificate, which will subsequently write to the cert.txt file.
If a client browses the ASP file and no client certificate displays in the Client Authentication window, a problem exists with the CA information in the IIS metabase. To repair the problem, rerun the three commands from the IIS installation root directory (Iisca, NET STOP iisadmin /y, and NET START w3svc). The cert.txt file will now contain the client certificate, which will look similar to Listing 2. Copy callout A of Listing 2 into your favorite text editor, and save to a file.
Now you can create a mapping between this client certificate and an NT user account. Select the directory you want to secure from the IIS 4.0 Directory Security tab, and select the permissions you see in the Secure Communications dialog box that Screen 6, page 129, shows. This permission combination sets up a requirement for a valid certificate for Web access. Click Edit in the Secure Communications dialog box to create the client certificate mapping. (You can create wildcard mappings; however, here I describe only individual mapping.) Ensure that you select the Basic tab in the Account Mappings dialog box, which Screen 7 shows, and click Add to import the certificate text file you created when you copied callout A of Listing 2. You'll see a prompt asking for the certificate text file. Enter the path and filename for this file, and click OK. On the Basic tab of the Account Mappings dialog box, assign the mapping a name, enter the NT account name (e.g., the IUSR_server name) of the user who needs access to the secured area, then enter and confirm the NT user password of the account you want to map the client certificate to. A successful mapping will look similar to the one in Screen 7.
Congratulations—You're a CA
That's it! You have created client certificates for your users, captured those certificates to text files, and subsequently mapped the certificates to NT user accounts. Your users can now access your secured Web area without having to use the traditional username and password mechanism. Your users will be happy about the simplified Web access that client certificates make possible, and you'll sleep better knowing your secure Web areas are truly secure.
End of Article
Register
Steve Katsirubas August 06, 1999