Question

I have an application written in Rails that must be ran behind a IIS server due to restrictions by the client, the government. We have to have SSL authentication. So what I can’t figure out in my hours of searching Google is how to get IIS to pass the client certificate to the rails server (thin).

I’ve seen tutorials on Apache that use:

SSLOptions +ExportCertData

Which then make it available to the request object. Any ideas on how to configure IIS to do the same?

Answer 1

After being told this may be impossible. I’ve finally figured it out! Here are the steps that I took.

1. Using OpenSSL create your own CA certificate.
2. Using the generated CA certficate create and sign other certificates with Open SSL.
3. Open Internet Information Service Manager click on the server, then click on server certificates.
4. Click Import under the Actions column
5. After importing click on your site.
6. In the Actions column click bindings…
7. Click add, scroll to https, and select the CA certificate that you imported
8. Click on your site again to get to the menu and click on SSL settings
9. Check require SSL and then click the radio buttion, require
10. Click your site again then click on the configuration editor (installed in IIS 7.5 can add-in in 7.0)
    
11. Go to system.webServer/security/authentication/iisClientCertificateMappingAuthentication
12. Set enabled to true
13. Set manyToOneCertificateMappings to true
14. Click on the … box on the far right-end of manyToOneMappings
15. Click add under actions column, under collections
16. Add the username and password of the user you created (can be on local machine)
17. Now, go to the main server and restart.
18. You should be able to see the certificate using request.headers hash.

Variables for the hash include:

• CERT_SERIALNUMBER
• CERT_SUBJECT
• CERT_ISSUER
• HTTPS_SERVER_ISSUER
• HTTPS_SERVER_SUBJECT

If you cannot find something you may have to install a module (for like authentication). I don’t remember which ones I installed.