-
Notifications
You must be signed in to change notification settings - Fork 25.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Use client certificates to secure a portion of an ASP.NET Core web site #18720
Comments
create-child-certificate-from-root-certificate I have been trying to follow this guide using an API with a single endpoint. I've created the root cert and then a child cert. I've added the root cert to the site binding in IIS and set certificates as Required in the sites SSL Settings. When I try to Post to the endpoint in Postman, I get this error: Error: error:0900006e:PEM routines:OPENSSL_internal:NO_START_LINE |
I have looked at all the optional client certificate samples, but they all require a separate binding to accomplish this. My use requires the same binding to be used, but based on the SNI set whether a client certificate is required. Currently I can accomplish this by setting: ClientCertificateMode = ClientCertificateMode.AllowCertificate and validating the client certificate downstream responding appropriately. I would like to have client certificates required for aaa.com but not for bbb.com on port 443. The problem with the above config is that browsers, like Chrome, will request the user to select a client certificate, even though you can cancel the request and continue, it's not an ideal solution. Surely if we can select the server certificate to present on the ServerCertificateSelector, we should be able to set if the client certificate is required or not per SNI? |
5.0 Added this capability: |
We need to doc this. Those issues don't make it easy to know how to accomplish this. |
The doc issues are included in the links above. (Stop distracting Stephen with shiny things.) |
Thank you very much, this works perfectly... I knew it should be possible, and following the PRs I could see that it was implemented, just wasn't sure how. Looking at one of the test cases provided the right answer for me, I do all the setup in code, not via the json config: listenOptions.UseHttps((connection, stream, clientHelloInfo, state, cancellationToken) => |
I think this can be closed as the linked docs issues were completed. Let me know if there's work to do here. |
Feedback for Optional client certificates
Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.
The text was updated successfully, but these errors were encountered: