Digital Certificates in an ASP.NET application

Question

I have a .NET application (C#) and for security reasons, I was asked to request users that they install a certain certificate in their browser and then check if user's browser has the certificate installed in it.

How can I create a certain digital certificate?

How can I check if user's browser has this certificate installed?

Answer 1

On windows I think that you have 3 options:

• create the certificate using Certificate Server Services included in any version of windows server. See http://d3planet.com/rtfb/2009/11/10/install-certificate-services-on-windows-server-2008-r2/
• buy a certificate from a certificate authority like verysign
• create a certificate using makecert.exe tool. Best solution for testing but in some case can be an option. See http://msdn.microsoft.com/en-us/library/bfsktky3(v=vs.80).aspx

To check if the client has the certificate installed you can check the Request.ClientCertificate property but it is better to configure iis to only accept request with a valid certificate. You can use the "Require client certificates" option inside the iis security setting and then you can also map a specific certificate to a windows account for a better user authentication. See http://support.microsoft.com/kb/315588 for a full example.