0

I'd like to set up IIS to listen on 127.0.0:80, and on *:443, so http connections are allowed from localhost only, while anyone from the net will have to use SSL. (This part is no problem). Also, i want to require the SSL connections to use client certificates, but not the HTTP connections. This is what i can't seem to be able to do.

The IIS is a 8.5.9600.16384 running on Windows Server 6.2 (2012 R2).

Background, not required to answer the question

We have a site that our IT security requires us to use smartcard client certificates for. The software has a native admin UI, that does HTTP/XML/Soap/whatever calls to the web server. This native admin UI can't be configured to use client certificates; also, even if it could, IT security wouldn't allow us to create a "static" certificate that doesn't need a smartcard+pin. So, i want the admin software to use http on 127.0.0.1 only - without certificate - while still requiring users to use https and certificates. Being able to run the admin software on the web server only doesn't hurt much. And yes, i'm aware that i have to double-check nothing is running on the server that could act as a proxy to fool the 'localhost-only' check.

I tried to set up a second site as described in the "Extra Localhost-Only IIS Site" section for moveit (different software but same problem), but this broke my software completely. The software is trying to read the IIS configuration to configure itself, and gets confused horribly if it's running on two web sites. So i'm stuck with "one web site, two bindings", but with this, IIS doesn't allow me to "require client certificates, but only on the SSL port".

Guntram Blohm
  • 569
  • 2
  • 7
  • Hi, I was wondering if you found a way to accomplish it, I have the same need, thanks in advance. – Y.S Mar 10 '15 at 13:50
  • No, never found a solution. What we finally did was set up an apache server to do this. The apache interally redirects .* to /helper/$1; /helper is a program that checks the certificate on HTTPS, and assumes a fixed name on localhost Port 80. Then, it just passes through the PATH_INFO to IIS, sends the user name in a Basic-Authentication header, and returns the result to the browser. IIS listens on localhost:8765 only and uses Basic Auth. Horrible hack, and not exactly a performance boost, but it seems open source is the only way around microsoft's broken assumptions. – Guntram Blohm Mar 10 '15 at 17:56

0 Answers0