iis security: Currently I have a win2k web server with secure server ID
installed and hosting web page www.abc.com. I have tested
browsed to the web site by key in web site
https://www.abc.com and it was working fine. The
connection is as below:


Client web browser < ------------------ > web server
https://www.abc.com


Now I would like to enhance the security by introduce
digital certificate for client. I managed to setup an
additional stand-alone CA server (windows 2000 server) and
able to do the following tasks.

1. User access to stand alone CA server to request for
certificate.
2. System Administrator manually approves the user request.
3. User connects to the CA server again to download and
install certificate into web browser.


My questions are:
1. How to setup the connection for CA server and web server
2. How is the over all connection look like? (connection
A, B or C)
3. How to do the authentication?

Connection A

Client web browser < -----> CA server < ---- > web server


Connection B

Client web browser < ---- > web server < ---- > CA server


Connection C

Client web browser < --------- > web server & CA server

Hi,

The following should help:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;257591
Description of the Secure Sockets Layer (SSL) Handshake

http://support.microsoft.com/default.aspx?scid=kb;EN-US;257586
Description of the Client Authentication Process During the SSL Handshake

http://support.microsoft.com/?id=257587
Description of the Server Authentication Process During the SSL Handshake

Cheers
Ken

[quoted text, click to view]
: Currently I have a win2k web server with secure server ID
: installed and hosting web page www.abc.com. I have tested
: browsed to the web site by key in web site
: https://www.abc.com and it was working fine. The
: connection is as below:
:
:
: Client web browser < ------------------ > web server
: https://www.abc.com
:
:
: Now I would like to enhance the security by introduce
: digital certificate for client. I managed to setup an
: additional stand-alone CA server (windows 2000 server) and
: able to do the following tasks.
:
: 1. User access to stand alone CA server to request for
: certificate.
: 2. System Administrator manually approves the user request.
: 3. User connects to the CA server again to download and
: install certificate into web browser.
:
:
: My questions are:
: 1. How to setup the connection for CA server and web server
: 2. How is the over all connection look like? (connection
: A, B or C)
: 3. How to do the authentication?
:
: Connection A
:
: Client web browser < -----> CA server < ---- > web server
:
:
: Connection B
:
: Client web browser < ---- > web server < ---- > CA server
:
:
: Connection C
:
: Client web browser < --------- > web server & CA server
:
: