1

I've been trying to set up a website with 2 way SSL in IIS 10. It's not going so great.

Already have a domain I got through NameCheap, and have DNS through CloudFlare (DNS only, no proxy).

The server has a certificate for that domain which I got through Certify with Let's Encrypt.

On that server I set up AD CS and used it to create a Certificate Authority.

CA Web Enrollment is active and accepts requests only from a VPN connection set up through RRAS (I didn't want it open to the internet, and BTW the VPN connection uses the certificate I got earlier, so that's working correctly).

The client PC started a certificate and sent it to the server using CA Web Enrollment through the VPN. That request was then issued, and the resulting certificate and the CA were then imported to the CurrentUser\My, LocalMachine\TrustedRoot stores respectively. I also checked that the client certificate has a private key.

So far the situation with the certificates is:

-Server: CA (LocalMachine\TrustedRoot(no key) and LocalMachine\My(key)), Server Certificate (LocalMachine\My(key)).

-Client: CA (LocalMachine\TrustedRoot(no key)), Client Certificate (CurrentUser\My(key)).

Then comes the IIS configuration: There are three sites on the server. 1st one is the default one with the certsrv app, that one listens only on the VPN ip and localhost, and only has HTTPS active with server certificate (ports 443 both). 2nd one is an FTP site which only listens on the VPN IP and port 21. This ones are irrelevant, I mention them only because I don't want to leave anything out.

3rd one is the one we care about. It listens on the domain name, any ip, and has both HTTP and HTTPS active (both with ports 80 and 443 respectively). HTTP is only active so URL Rewrite can redirect it to HTTPS, and HTTPS uses the server certificate.

This site has SSL required enabled and Client Certificates as required.

In Authentication all methods are disabled.

In system.webServer/security/authentication/iisClientCertificateMappingAuthentication I have Enabled set to true, and manyToOneCertificateMappingsEnabled set to true. Inside manyToOneMappings I have one item mapped to a user on the server, and inside rules I have one with certificateField=Issuer, certificateSubField=CN, and matchCriteria="name of the CA I created".

A registry key named SendTrustedIssuerList with a value of 1 was created inside Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL.

The server certificate was removed and re added with clientcertnegotiation=enabled to the domain:443 binding on the site using netsh in powershell.

Lastly, I used IISCrypto from https://www.nartac.com/Products/IISCrypto/ to set up protocols inside Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.

That's all I've done so far and it should cover all responses to similar issues all over the internet, but all it does is give me a 403.7 error. I used wireshark to check the TLS traffic during a connection attempt and the server does seem to send the request certificate with the trusted CA list (my CA included on the list) but i can't get any browser to prompt me for a client certificate. Oh forgot to mention I did add the CA and client certificates through the browsers and IE 11 has de Do not prompt when you only have one cerrificate option as disabled, but still nothing.

Any ideas?

thexbuttonisntworking
  • 11
  • 1
  • 5

1 Answers1

0

Got it working in the end. IIS was set up properly, the issue was with the certificates, dunno why but the browsers didn't like them. So I removed AD CS from the server and remade the CA and client certificate with powershell. This new certificates are working just fine and all browsers prompt me for them after putting them where they have to go.

BTW the powershell commands were the following:

$params = @{
   DnsName = "CA Name"
   KeyLength = 2048
   KeyAlgorithm = 'RSA'
   HashAlgorithm = 'SHA256'
   KeyExportPolicy = 'Exportable'
   NotAfter = (Get-Date).AddYears(5)
   CertStoreLocation = 'Cert:\LocalMachine\My'
   KeyUsage = 'CertSign','CRLSign'
}

$rootCA = New-SelfSignedCertificate @params

Export-Certificate -Cert $rootCA -FilePath "C:\path\to\file\ca-public.crt"

Import-Certificate -CertStoreLocation 'Cert:\LocalMachine\Root' -FilePath "C:\path\to\file\ca-public.crt"

$params = @{
   Subject = "Client Name"
   Signer = $rootCA
   KeyLength = 2048
   KeyAlgorithm = 'RSA'
   HashAlgorithm = 'SHA256'
   KeyExportPolicy = 'Exportable'
   NotAfter = (Get-date).AddYears(5)
   CertStoreLocation = 'Cert:\LocalMachine\My'
}

$clientCert = New-SelfSignedCertificate @params

Export-PfxCertificate -Cert $clientCert -FilePath "C:\path\to\file\client-private.pfx" -Password (ConvertTo-SecureString -AsPlainText 'password' -Force)

Then you just have to import certificates to the aproppiate stores on the client machine.

Dunno what was missing from the certificates created with AD CS, but I'm glad to have a working solution.

thexbuttonisntworking
  • 11
  • 1
  • 5