0

On an IIS 10.0 server hosting https://example.com, what do I put in my applicationHost.config so that all of the following is true:

<configuration>
   <location path="">
      <system.webServer>
         <defaultDocument enabled="true">
            <files>
               <add value="index.html" />
            </files>
         </defaultDocument>
         <security>
            <access sslFlags="Ssl, SslNegotiateCert, SslRequireCert, Ssl128">
         </security>
      </system.webServer>
   </location>
   <location path="index.html">
      <system.webServer>
         <security>
            <access sslFlags="Ssl, Ssl128">
         </security>
      </system.webServer>
   </location>
   <location path="/">
      <system.webServer>
         <security>
            <access sslFlags="Ssl, Ssl128">
         </security>
      </system.webServer>
   </location>
</configuration>

does not work because <location path="/"> is not allowed.

rossmpersonal
  • 49
  • 1
  • 5
  • Sorry, I can’t understand your needs, can you clear your needs explanation? – samwu Oct 01 '20 at 08:39
  • I have rewritten my question to clarify my needs. Please try to answer it. Please let me know if my question still is not clear. – rossmpersonal Oct 01 '20 at 15:35
  • What does "/" mean in path and sslFlags? if you want to unlock for all sites, you can set the value of path to `` . – samwu Oct 05 '20 at 07:33
  • @samwu , unlocking for all sites by setting the value of path to `` is the exact opposite what I am trying to do. ` ` would cause `https://example.com/*` to not request a client certificate. `https://example.com/*` requests a client certificate, with the exceptions of `https://example.com/` and `https://example.com/index.html` , which do not request a client certificate – rossmpersonal Oct 07 '20 at 02:27
  • If you can to lock specific website you can refer to this link: [https://learn.microsoft.com/en-us/iis/get-started/planning-for-security/how-to-use-locking-in-iis-configuration](https://learn.microsoft.com/en-us/iis/get-started/planning-for-security/how-to-use-locking-in-iis-configuration) – samwu Oct 09 '20 at 08:00
  • @samwu , I read the link and I don't understand how it is relevant to this question. I am not trying to lock the specific website. I don't understand how locking a website or anything else for that matter is relevant to the question. Please enlighten me as to how it is relevant. – rossmpersonal Oct 12 '20 at 02:39
  • You said above unlocking for all sites is the exact opposite what I am trying to do. – samwu Oct 13 '20 at 09:51

0 Answers0