how to use client certificate in IIS manager?

Question

Hi everybody

I use IIS manager (v10) in windows 10 (21H2) and have certificate of client. i know that tick "require" in client certificate (SSL settings). but when client open the page (in chrome), get 403 error ("403 - Forbidden: Access is denied. You do not have permission to view this directory or page using the credentials that you supplied.").

certificate installed in client.

I want user with specific certificate can access the website.

client is not in domain/workgroup.

Answer 1

Hi Saleh Kheradmand,

When you enable “Require” under SSL Settings > Client Certificates, IIS expects the browser to present a valid client certificate during the HTTPS handshake. If the certificate is missing, not trusted by the server, or doesn’t match what IIS expects, you’ll get a 403 error — usually 403.7 (client certificate required) or 403.16 (certificate is untrusted).

Since your client isn’t joined to a domain or workgroup, IIS won’t be able to map the certificate to a Windows account automatically — so we’ll need to handle that manually.

Here’s what I recommend checking:

1. Make sure the server trusts the client certificate

• On the IIS server, run mmc.exe (press Win + R, type mmc, hit Enter).
• Go to File > Add/Remove Snap-in > Certificates > Local Computer.
• Import the CA certificate (the one that issued the client cert) into Trusted Root Certification Authorities or Intermediate Certification Authorities.

2. Configure SSL settings in IIS

• In IIS Manager, go to your site > SSL Settings.
• Check Require SSL and set Client Certificates to Require.

3. Disable Anonymous Authentication

• Go to Authentication for your site in IIS.
• Disable Anonymous Authentication.
• If you're not using domain accounts, you can skip enabling Windows Authentication — instead, you’ll need to use certificate mapping.

4. Set up certificate mapping (optional but important)

• If you want to allow only specific certificates, you can configure One-to-One Certificate Mapping in IIS.
• This lets you map a specific client certificate to a local Windows account (even if the client isn’t on a domain).
• Guide: Configure One-to-One Certificate Mapping in IIS

5. Test in Chrome

• Chrome should prompt the user to select a certificate when visiting the site.
• If it doesn’t, make sure the certificate is installed in the Personal store (you can check by running certmgr.msc on the client).
• Also, try accessing the site using the hostname (not IP address), as Chrome may skip certificate prompts for IPs.

For more helpful documents:

• https://learn.microsoft.com/en-us/iis/configuration/system.webserver/security/authentication/iisclientcertificatemappingauthentication/
• https://learn.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis
• https://learn.microsoft.com/en-us/iis/configuration/system.webserver/security/authentication/clientcertificatemappingauthentication

Answer 2

Hello ,

 

Thank you for posting in QA forum.

To configure Client Certificate Mapping Authentication, please kindly try below steps:

1.Please install IIS Client Certificate Mapping Authentication Feature on the server.

2.In IIS Manager, please select the website you want to configure > in the Features section, double-click Authentication > select Enable for Client Certificate Mapping Authentication and apply.

3.In IIS Manager, select the website > in the “Features” section double-click SSL Settings > Under Client Certificates, select Require > Click Apply in the Actions pane.

Meanwhile please go to IIS server > Server Certificates > Create Client Certificate Mapping and map the client certificate to a user account.

REF:

https://learn.microsoft.com/en-us/iis/configuration/system.webserver/security/authentication/clientcertificatemappingauthentication

https://learn.microsoft.com/en-us/iis/configuration/system.webserver/security/authentication/iisclientcertificatemappingauthentication/

 

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.



Regards,

Jill Zhou