"Scott" <anonymous@discussions.microsoft.com> wrote in message
news:1686b01c41778$bf17f830$a301280a@phx.gbl...
> Can anyone tell me if it is possible to require client
> authentication on IIS but disable the Trust Lists so that
> any certificate can be used? i.e. can I get the browser to
> prompt for all certificates irrespective of their trust
> anchor?

>-----Original Message-----
>
>"Scott" <anonymous@discussions.microsoft.com> wrote in
message
>news:1686b01c41778$bf17f830$a301280a@phx.gbl...
>> Can anyone tell me if it is possible to require client
>> authentication on IIS but disable the Trust Lists so
that
>> any certificate can be used? i.e. can I get the
browser to
>> prompt for all certificates irrespective of their trust
>> anchor?
>
>Hi,
>
>If I'm understanding your question, you want to have
anyone with any client
>certs have all of the client certs on their browser
display when they
>connect to your IIS server?
>
>If the above is a correct interpretation, then I think
that you can't really
>do this.
>
>Part of the SSL protocol is that the server will send
out a list of CAs that
>it trusts. The list of CAs that IIS will send out will
be the CAs in the
>Trusted Root Authorities that have the "Client
Authentication" purpose
>enabled.
>
>If your client has a client cert from "Joe's CA", but
the IIS machine
>doesn't have the CA cert from "Joe's CA", then "Joe's
CA" will not be
>included in the list of trusted CAs sent out during the
SSL handshake.
>
>If the above is what you want, then why don't you just
not enable "require
>client authentication" on IIS?
>
>I don't quite understand why you might want to do what
you want to do, since
>then anyone with a client cert from any CA (and anyone
can get a free one
>from someplace) that MS just happens to have included in
the Trusted Root
>Authorities would be able to get into your server.
>
>Jim
>
>
>.
>

<anonymous@discussions.microsoft.com> wrote:

>Can anyone tell me if it is possible to require client
>authentication on IIS but disable the Trust Lists so that
>any certificate can be used? i.e. can I get the browser to
>prompt for all certificates irrespective of their trust
>anchor?