title: Setting up IIS client certificate mapping authentication (Client requires private key)
body: <p>I have started developing a secure web service and I am learning SSL concepts.</p>
  
  <p>Requirement: I want to secure my Web Service (Allow access to web requests that have client certificate added to their request). A client can send request from desktop/web/console application to our web service. </p>
  
  <p>What I Have(Resources):</p>
  
  <p>A valid Certificate issued to my site *.wildcard.com, this certificate is installed on my server machine having public IP, and domain mapped to wildcard.com. This certificate is used to setup SSL binding(443) for my site.
  This certificate's purpose is Server Authentication (1.3.6.1.5.5.7.3.1)
  Client Authentication (1.3.6.1.5.5.7.3.2).</p>
  
  <p>What I have tried till now:</p>
  
  <p><strong>Server Side Environment</strong></p>
  
  <p>On IIS, I have setup my webservice @<a href="https://wildcard.com/SSLTest/Connect.asmx" rel="nofollow noreferrer">https://wildcard.com/SSLTest/Connect.asmx</a> and set SSL Settings as:</p>
  
  <p>[SSL Settings IIS] (<a href="https://drive.google.com/file/d/1BGqXjj1Xh365lSm0NU_jXr0CheR6DpK5/view?usp=sharing" rel="nofollow noreferrer">https://drive.google.com/file/d/1BGqXjj1Xh365lSm0NU_jXr0CheR6DpK5/view?usp=sharing</a>)</p>
  
  <p>Then, under configuration Editor -> system.webServer/security/authentication/iisClientCertificateMappingAuthentication</p>
  
  <p>I tried to setup onetoOneMappings as:</p>
  
  <p>[OnetoOneMapping] (<a href="https://drive.google.com/file/d/1vga_cieP-8iJzl9aLflGTFP-yDaG0xn4/view?usp=sharing" rel="nofollow noreferrer">https://drive.google.com/file/d/1vga_cieP-8iJzl9aLflGTFP-yDaG0xn4/view?usp=sharing</a>)</p>
  
  <p>in the above settings, certificate is the value between Begin and End Certificate Line from .cer file(public key) generated using SSL certificate.</p>
  
  <p><strong>Client Side Environment:</strong></p>
  
  <p>I have written a console application(C#.net), which sends SOAP request using HTTPWebRequest of .net framework and adds client certificate to the request object as</p>
  
  <pre><code>webRequest.ClientCertificates.Add(cert);
  </code></pre>
  
  <p>This certificate is picked from client machine using:</p>
  
  <pre><code>X509Store computerCaStore = new X509Store(StoreName.My, StoreLocation.LocalMachine);
  </code></pre>
  
  <p>and then a request is sent to <a href="https://wildcard.com/SSLTest/Connect.asmx" rel="nofollow noreferrer">https://wildcard.com/SSLTest/Connect.asmx</a>.
  But I am getting, error 403.7 Forbidden Error. When I send certificate(with private key) then this works.</p>
  
  <p>Is it compulsory to send private key from the client machine in the request?
  If yes then security is compromised as we can't share private key with others.
  So how I am going to distribute public key to clients so that they can access web service. Or maybe I have misunderstood the scenario? What is the use of 
  iisClientCertificateMappingAuthentication on IIS?</p>
  
  <p>~Thank You</p>