How to configure IIS client certificate mapping authentication for IIS7

There are some articles about how to configure the Mutual Certificate authentication on IIS. But the steps are not very clear. Here is a detailed step by step procedure to configure the IIS client certification mapping authentication for IIS 7.

Firstly, there are several pre-requisites.

  1. Trusted CA root certificate.
  2. Server Certificate from a trusted CA.
  3. Client Certificate from a trusted CA.

Server side:

Install the server certificate on the server side.

1. Open mmc console, add the certificate for the Local Computer.



2. Import the CA root certificate to Trusted Root Certification Authorities and server certificate to Personal folder.


IIS configuration:

1. Open Inetmgr, click Server Certificates.


2. Import the server certificate as below.


3. Click the website which need mutual certificate authentication. Click bindings… and set it as below. Select the imported server certificate in the SSL certificate dropdown list.


4. Click SSL settings in the middle panel and select Require SSL and Require for Client certificates.


5. Double click the Authentication icon and disable all the Authentication method.


6. Make sure the IIS Client Certificate Mapping Authentication is installed.


If not, please install it as below.


7. Click the Configuration Editor in the middle panel and set the one to one mappings refer to this link .

You can also configure this by install the Client Certificates UI by this link.

On the client side:

1. Open MMC console and import the client certificate and CA root certificate. Import them to the Current User account.


2. Check if the client certificate exist in the content->certificate as below.


3. Try to visit the website and the client certificate will pop up. This is not popped up if there is only one client certificate by default. Here I configure the IE browser to prompt the dialog even only one client certificate is available. Please do it as below.



4. Here you go.





Chao Liang from GBSD DSI Team

Comments (6)

  1. gilad says:

    Great help


  2. RAWAIN says:

    Hi,  I followed your steps but I am getting the error message as

    Error message that I am seeing is “(Error(HTTP 403 forbidden) means that Internet Explorer was able to connect to the website , but it does not have permission to view the web page)”

    Any Help

  3. Andres says:

    met too 🙁 fighting for weeks this error

  4. many thanks! says:

    great help, it works!

  5. Prashant Channe says:

    You may want to check the IE settings:

    Configuring IE with client certificate

    1. On the workstation open IE -> go to internet options -> Content -> Certificates
    2. Click on import and select the client certificate

    3. Under Internet Options -> Security -> select Custom level and enable the setting “Don’t prompt for client certificate selection when only one certificate exists”

    When there only one client certificate in personal store the site connection would not prompt for client certificate selection when the above option is selected

  6. Andres says:

    is there a way to call for authentication in one button on dot net for example ? I need to sign a xml document, do not need in logging or authentication.

Skip to main content