Specifying criteria for client certificate authentication

[thomaslevesque]

I need to setup client certificate authentication for a web app. I have a POC that works fine, except one thing: I can't figure out how to specify criteria for the client certificate (so that the browser only shows matching certificates when it prompts the user to pick one).

I know it's possible, because I've seen sites that did it, and the TLS RFC mention that the CertificateRequest can contain extensions "describing the parameters of the certificate being requested".

However, I can't find a way to do this with ASP.NET Core. I need to support this on IIS (for hosting in Azure App Service) and, if possible, on Kestrel (for local development).

Is it even possible?

[Tratcher]

What criteria did you have in mind? The only one I know of is the list of allowed cert issuers the server will accept.

That feature isn't currently available for Kestrel, see dotnet/runtime#45456. That feature ask shows the existing IIS/Http.Sys for comparison. It's a bit complex, I don't know if app service would support it.

[thomaslevesque]

Thanks @Tratcher.

What criteria did you have in mind? The only one I know of is the list of allowed cert issuers the server will accept.

I think that would be enough for my scenario

Thanks for the link, seems interesting. Unfortunately I don't think I can issue netsh commands on Azure App Service...

[Tratcher]

No, but you can ask if they support the feature directly.

[thomaslevesque]

I asked on the MVP mailing list, and got this answer:

No – sorry – since TLS negotiations terminate on the App Service front doors, there is not a way to program the front doors with this capability.

So, I guess that's it for Azure...