|
Authentication -- Certificate Based
written and ©1998, 99 by Kevin Flick www.flicks.com
creator of Authentix
Client certificates are an advanced form of
authentication, and at this time they are still very much in their infancy with respect to
compatibility and ease of use.
Certificate based authentication
is the way to go if :
- you want a high degree of certainty of the identity of the
users accessing your site
- You accept the need for SSL and don't mind paying the
performance penalty.
- You already have a certificate or you don't mind paying for
one and setting it up.
You won't want
Certificate based authentication if :
- The process of issuing a client certificate is too complex and
intimidating for both you and your users
- You do not want the performance hit of having all protected
information exchanged via SSL
Definitions
- SSL = secure socket layer.
- MMC = Microsoft Management Console.
How to use Certificate based
authentication
Since this technology is still maturing, be sure to have the
latest version of IIS4 installed on your system.
- Obtain a certificate from a certificate issuing authority such
as Verisign or Thawte. Refer to the IIS documentation on Key Manager.
- Select a directory you want to protect in the MMC
- Click on the Secure Communicatations Edit button on the
Directory Security property sheet and use the certificate you obtained. Select both Enable
Client Certificates and Require Client Certificate
- Enable client certificates for this resource
- Issue client certificates for access to this resource.
There are several good references to help understand and use
Client Certificate technology. Some articles that are recommended include:
- "Internet Information Server 4.0 - Security for the
Web-Enabled Enterprise" by Nick Evans in the Premier Edition of Security Advisor by
Advisor.com publications, and
- "Web Project, Digital IDs" by Jon Udell in the March
Edition of Byte magazine.
- "Issuing digital certificates with Microsoft Certificate
Server" section of the IIS Security White Paper by Microsoft.
|